CVSS 4.0
9.2 criticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2026-119717
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.
Severity
CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
References
- https://github.com/up9inc/pybars4
- https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_compiler.py#L153-L154
- https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md
- https://www.vulncheck.com/advisories/pybars4-through-0.9.13-code-injection-via-bracketed-path-segments