opensearch-project / opensearch-project/sql
CVE-2026-7246 (High) detected in click-7.1.2-py2.py3-none-any.whl
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 176
- Forks
- 229
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 43
Description
CVE-2026-7246 - High Severity Vulnerability
Vulnerable Library - click-7.1.2-py2.py3-none-any.whl
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/d2/3d/fa76db83bf75c4f8d338c2fd15c8d33fdd7ad23a9b5e57eb6c5de26b430e/click-7.1.2-py2.py3-none-any.whl
Sample Path to Dependency File: /doctest/requirements.txt
Path to vulnerable library: /tmp/ws-ua_20260918220638_SLGDVQ/python_XUORPK/202609182206391/env/lib/python3.10/site-packages/click-7.1.2.dist-info
Dependency Hierarchy:
- ❌ click-7.1.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 743d51f1c7752fdbc962f9cd3fe502e285adbbed
Found in base branch: main
Vulnerability Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-30
URL: CVE-2026-7246
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-30
Fix Resolution: https://github.com/pallets/click.git - 8.3.3
⛑️ Automatic Remediation will be attempted for this issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with /doctest/requirements.txt and inspect how click 7.1.2 is declared. Update the dependency to the suggested fixed version, 8.3.3, then run the repository's dependency or doctest checks. Done means the project no longer includes the vulnerable click version and the security scan no longer reports CVE-2026-7246.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100