CRITICAL 9.2 NVD
CVE-2026-119716
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
References
- https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pyba
- https://github.com/wbond/pybars3
- https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160
- https://github.com/wbond/pybars3/issues/88
- https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-pa
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-30 via NVD.
Risk Timeline
CVE Disclosed2026-10-30 · -1 days ago
Remediation Resources
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.