CVE-2026-7246: Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

Overview

Severity

High (CVSS 7.2)

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Exploit Status

Not Exploited

Patch Tuesday

2026-Apr

Released

2026-05-17

Last Updated

2026-05-19

EPSS Score

0.03% (percentile: 9.0%)

Affected Products (2)

Other

• 21343-17084

Open Source Software

• azl3 tensorflow 2.16.1-11 on Azure Linux 3.0

Revision History

• 2026-05-17: Information published.
• 2026-05-18: Information published.
• 2026-05-19: Information published.