CVE-2026-119716
pybars3 through 0.9.7 Code Injection via Bracketed Path Segments
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
| CWE | CWE-94 |
| Vendor | wbond |
| Product | pybars3 |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for wbond pybars3
Be the first to know when new high vulnerabilities affecting wbond pybars3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
wbond / pybars3
0 ≤ 0.9.7
References
github.com: https://github.com/wbond/pybars3/issues/88 github.com: https://github.com/wbond/pybars3 github.com: https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md github.com: https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160 vulncheck.com: https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-path-segments
Credits
Vladislav Korchagin