Pallets Click, versions 8.3.2 and below, contain a command injection flaw in the click.edit() function that allows an attacker to supply a malformed filename containing arbitrary operating-system commands. According to Pallets Click, this vulnerability was disputed and is not considered valid by the project. The result of the injection would be the execution of those commands with the privileges of the user running the application, which could lead to a full compromise of the affected system. The weakness is an example of uncontrolled command injection, identified as CWE-77 and CWE-78. The likely attack vector is inferred from the description as an attacker supplying an unsanitized filename to click.edit() through user input or configuration, which enables the injection of OS commands.

Versions of Pallets Click up to and including 8.3.2 are vulnerable. All users of these releases that invoke click.edit() with filenames derived from untrusted input may be affected.

The CVSS score of 7.2 indicates a high severity vulnerability that could provide an attacker with remote code execution capabilities. The EPSS score of less than 1% suggests that exploitation of this flaw is currently unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw can be triggered by unsanitized user input to click.edit, an attacker with sufficient access to supply such input, such as a local user or a compromised web application, could potentially execute arbitrary commands under the application's user context. The exploitation path requires the application to invoke click.edit with a filename containing shell meta‑characters; if the input is not properly sanitized, the underlying operating system will interpret the meta‑characters as commands, leading to arbitrary code execution.