Pallets Click Command Injection Vulnerability in click.edit() Function

A command injection vulnerability has been identified in Pallets Click versions prior to 8.3.3. The issue arises in the click.edit() function, where unsanitized filenames are passed to the operating system command interface. This allows attackers to execute arbitrary commands from an unprivileged account.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the host operating system.

Reproduction

To reproduce this vulnerability, use a version of Pallets Click prior to 8.3.3. The vulnerability can be triggered by calling the click.edit() function with a filename that includes double-quote characters and shell metacharacters. The injected command will be executed in the shell because the filename is not properly sanitized before being passed to subprocess.Popen() with shell=True.

Remediation

Users are advised to upgrade to Pallets Click version 8.3.3 or later.