Unpin click to remediate CVE-2026-7246 by RyanL1997 · Pull Request #78 · opensearch-project/sql-cli

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 · 2026-08-03T17:02:54Z

Description

Replaces the exact click == 7.1.2 pin in setup.py with a version requirement that admits the CVE-2026-7246 fix.

CVE-2026-7246 (High, CVSS 7.2) is a command injection in click.edit(), affecting click <= 8.3.2 and fixed in 8.3.3.

Two things are wrong with the current pin:

It installs a vulnerable click.
Because it is an exact pin, it also forces the vulnerable version back into any environment that installs this package next to a patched click.

Point 2 is the one that reaches beyond this repo. opensearch-project/sql's doctest bootstrap clones this branch and installs it right after its own requirements:

$DIR/.venv/bin/pip install -r $DIR/requirements.txt # click 8.x$DIR/.venv/bin/pip install -e ./sql-cli # <-- drags click back to 7.1.2

So the pending remediation there (opensearch-project/sql#5471) cannot actually take effect until this branch is unpinned.

Why environment markers instead of `click >= 8.3.3`

The patched release is only published for Python >= 3.10 (every click >= 8.2 sets Requires-Python >= 3.10), while this branch still supports Python 3.9. Requiring 8.3.3 unconditionally makes the package uninstallable on 3.9:

ERROR: Ignored the following versions that require a different python version: ... 8.3.3 Requires-Python >=3.10
ERROR: No matching distribution found for click==8.3.3

So the requirement is split by marker — interpreters that can take the fix are required to, and 3.9 resolves to the newest release available to it:

'click >= 8.3.3; python_version >= "3.10"',
'click >= 8.1.8, < 8.2; python_version < "3.10"',

Worth stating plainly: on Python 3.9 this lands on click 8.1.8, which is still inside the CVE's affected range, because upstream never backported the fix to a 3.9-compatible release. There is no version constraint that fixes 3.9 — that requires either moving off Python 3.9 or dropping the click dependency. This change fixes every interpreter that can be fixed and, more importantly, stops this package from downgrading click for consumers that are already on 3.10+.

Exploitability here

click.edit() is not called anywhere in this package (the click surface used is command/option/argument/echo/secho/confirm/echo_via_pager/Path/STRING/INT). This is supply-chain hygiene and a downstream unblock, not a live vulnerability in the CLI.

Issues Resolved

Unblocks opensearch-project/sql#5445 and opensearch-project/sql#5471.

Note that #5471 needs a companion change: it currently pins click==8.3.3 flat in doctest/requirements.txt, which fails to resolve on the Linux CI image (Python 3.9) and aborts the whole install, taking zc.customdoctests with it — that is the actual cause of its red build-linux (…, doc) checks, and it needs the same marker treatment (or a CI Python bump).

Testing

Verified locally on Python 3.9.6 (same minor version as the sql Linux doctest image):

Downgrade is gone — with click 8.1.8 already present, pip install -e . previously reinstalled 7.1.2; it now leaves 8.1.8 in place.
Test suite — pytest tests/ → 25 passed, 5 skipped, identical to the click 7.1.2 baseline (no new failures, same skips).
CLI smoke test — opensearchsql --help renders correctly under click 8.
Downstream imports — the symbols sql's doctest/test_docs.py imports (Formatter, OpenSearchConnection, OutputSettings) all import cleanly under click 8.
Marker resolution — evaluated via packaging.requirements: 3.9 selects click<8.2,>=8.1.8; 3.10 and 3.12 select click>=8.3.3.

Check List

New functionality includes testing.
- All tests pass, including unit test, integration test and doctest
New functionality has been documented.
- New functionality has javadoc added
- New functionality has user manual doc added
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

sql-cli 1.0-legacy pinned `click == 7.1.2` exactly. That pin is vulnerable to CVE-2026-7246 (command injection in `click.edit()`), and because it is an exact pin it also forces the vulnerable version back into any environment that installs this package alongside a patched click. This is what blocks opensearch-project/sql#5471: the doctest bootstrap runs `pip install -r requirements.txt` followed by `pip install -e ./sql-cli`, so sql-cli's pin downgrades click again in the second step. The fix (click 8.3.3) is only published for Python >= 3.10, while this branch still supports Python 3.9, so the requirement is expressed with environment markers: interpreters that can take the patched release require it, and older ones resolve to the newest version available to them. `click.edit()` is not used anywhere in this package, so there is no exploitable path here; this is supply-chain hygiene and unblocks the downstream remediation. Verified on Python 3.9.6: - `pip install -e .` no longer downgrades click (stays at 8.1.8) - full test suite: 25 passed, 5 skipped -- identical to the click 7.1.2 baseline - `opensearchsql --help` and the doctest driver imports still work Signed-off-by: Jialiang Liang <jiallian@amazon.com>

dai-chen · 2026-08-13T17:54:52Z

Shall we merge the commit SHA fix and get CI pass?

RyanL1997 requested review from MaxKsyunz, Swiddis, YANG-DB, Yury-Fridlyand, anirudha, dai-chen, derek-ho, joshuali925, kavithacm, mengweieric, penghuo, ps48 and seankao-az as code owners August 3, 2026 17:02

RyanL1997 mentioned this pull request Aug 3, 2026
Pin GitHub Actions to full-length commit SHAs to unblock CI #79
Merged
6 tasks

Swiddis approved these changes Aug 17, 2026
View reviewed changes

Merge branch '1.0-legacy' into fix/cve-2026-7246-click-edit-injection
8ac7a40