Vulnerable Library - click-8.1.3-py3-none-any.whl
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/c2/f1/df59e28c642d583f7dacffb1e0965d0e00b218e0186d7858ac5233dce840/click-8.1.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Found in HEAD commit: c2f71f9de1c5a160aa4855528bce741034c691e7
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-7246
Vulnerable Library - click-8.1.3-py3-none-any.whl
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/c2/f1/df59e28c642d583f7dacffb1e0965d0e00b218e0186d7858ac5233dce840/click-8.1.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Dependency Hierarchy:
- ❌ click-8.1.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: c2f71f9de1c5a160aa4855528bce741034c691e7
Found in base branch: main
Vulnerability Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-30
URL: CVE-2026-7246
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-30
Fix Resolution: https://github.com/pallets/click.git - 8.3.3,click - 8.3.3
Step up your Open Source Security Game with Mend here
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/c2/f1/df59e28c642d583f7dacffb1e0965d0e00b218e0186d7858ac5233dce840/click-8.1.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Found in HEAD commit: c2f71f9de1c5a160aa4855528bce741034c691e7
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - click-8.1.3-py3-none-any.whl
Composable command line interface toolkit
Library home page: https://files.pythonhosted.org/packages/c2/f1/df59e28c642d583f7dacffb1e0965d0e00b218e0186d7858ac5233dce840/click-8.1.3-py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt,/requirements.txt
Dependency Hierarchy:
Found in HEAD commit: c2f71f9de1c5a160aa4855528bce741034c691e7
Found in base branch: main
Vulnerability Details
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-04-30
URL: CVE-2026-7246
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-30
Fix Resolution: https://github.com/pallets/click.git - 8.3.3,click - 8.3.3
Step up your Open Source Security Game with Mend here