CVE-2026-119717

HIGH 8.1

pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.

CWE	CWE-94
Vendor	up9inc
Product	pybars4
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for up9inc pybars4

Be the first to know when new high vulnerabilities affecting up9inc pybars4 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

up9inc / pybars4

0 ≤ 0.9.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md github.com: https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_compiler.py#L153-L154 github.com: https://github.com/up9inc/pybars4 vulncheck.com: https://www.vulncheck.com/advisories/pybars4-through-0.9.13-code-injection-via-bracketed-path-segments

Credits

Vladislav Korchagin