Read the docs
TI-2026-83192 Aliases CVE-2026-119717GHSA-x54v-7mw2-5rrx

Code injection in pybars4 lets attackers execute Python code

Priority MEDIUM 42CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

pybars4 through 0.9.13 contains a code injection flaw in pybars/_compiler.py, classified as CWE-94. Unescaped bracketed path segments in Handlebars templates break out of the generated resolve() string literal. A remote attacker who can supply a crafted template in a helper or block argument can execute Python code in the application process, without privileges or user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-02
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
up9incpybars4up to 0.9.13—No fix listedCNA
  • pybars4 Vendorup9inc Affected up to 0.9.13 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for pybars4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119717
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-10-30 Alias added: GHSA-x54v-7mw2-5rrx
  5. 2026-11-01 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2026-83191 Code injection in pybars3 and pybars4 via bracketed path segments CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences