Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS command…

Published:

29 april 2026 om 22:00:00

Alert date:

30 april 2026 om 15:02:17

Source:

nvd.nist.gov

Supply Chain & Dependencies, Web Technologies

Pallets Click versions 8.3.2 and below contain a command injection vulnerability in the click.edit() function. This security flaw allows attackers to execute arbitrary OS commands from an unprivileged account. The vulnerability affects the popular Python CLI library used by many applications. A fix is available in version 8.3.3. Organizations using affected versions should upgrade immediately to prevent potential exploitation.

Technical details

Mitigation steps:

Affected products:

Pallets Click