Read the docs
TI-2026-83191 Aliases CVE-2026-119716GHSA-xvx4-89q3-mchg

Code injection in pybars3 and pybars4 via bracketed path segments

Priority HIGH 81CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection flaw in pybars/_compiler.py where unescaped bracketed path segments are not sanitized. A template author can break out of string literals in helper or block arguments and run Python code in the application process (CWE-94).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wbondpybars3up to 0.9.7—No fix listedCNA
up9incpybars4up to 0.9.13—No fix listedCNA
  • pybars3 Vendorwbond Affected up to 0.9.7 Fixed in — No fix listed CNA
  • pybars4 Vendorup9inc Affected up to 0.9.13 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for pybars3 or pybars4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119716
  2. 2026-10-30 Alias added: GHSA-xvx4-89q3-mchg
  3. 2026-11-02 Title updated · CNA
  4. 2026-11-02 CVSS score changed · CNA
  5. 2026-11-02 Affected versions changed · CNA
  6. 2026-11-02 2 new references · CNA
  7. 2026-11-06 CISA SSVC decision points changed
  8. 2026-11-06 Priority changed: MEDIUM → HIGH

References

Advisory 1

Other 5

  • TI-2026-71620 Resource consumption in wbond certvalidator certificate path builder CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences