pybars3 through 0.9.7 Code Injection via Bracketed Path Segments (wbond pybars3)

CVE-2026-119716

CRITICAL 9.2

At a glance

Source: NVD
State: PUBLISHED
Published: 2026-10-30 15:16 UTC
Updated: 2026-10-30 15:16 UTC
Assigner: VulnCheck
NVD status: Deferred

Search on…

Description

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

Weaknesses (CWE)

CWE-94 — Improper Control of Generation of Code

References

Scores

Version	Score	Vector	Scored by
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · disclosure@vulncheck.com (Primary)

European references

ENISA EUVD · EUVD-2026-114121
GCVE · GCVE-0-2026-119716

Affected products

Product	Versions
wbond · pybars3	affected 0 ≤ 0.9.7

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 pybars3 through 0.9.7 Code Injection via Bracketed Path Segments (wbond pybars3)