CVE-2026-119716
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows…
- Risk score
- 64/100
- CVSS
- 8.1 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- pybars3 through 0.9.7 contains a code injection vulnerability that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply crafted Handlebars templates to break out of string literals and execute Python in the application process.
- Affected
- {'products': ['pybars3'], 'packages': [], 'versions': ['0.9.7']}
- Fix
- Check the linked advisory for a fix; no specific action given
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
- On your watchlist: python
References
- https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md
- https://github.com/wbond/pybars3
- https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160
- https://github.com/wbond/pybars3/issues/88
- https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-path-segments
Original description
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
Last activity 30 Oct 2026. Patch Forecast updates every hour.