Code Injection Vulnerability in pybars3 by Wbond
CVE-2026-119716

9.2CRITICAL

Key Information:

Vendor

Wbond

Status
Pybars3
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119716?

The pybars3 library, prior to version 0.9.7, is vulnerable to a code injection issue that allows attackers to execute arbitrary Python code through specially crafted Handlebars templates. By exploiting unescaped bracketed path segments in helper or block arguments, an attacker can break out of string literals and execute malicious Python code within the application's process, posing significant risks to the security of applications that rely on this templating engine.

Affected Version(s)

pybars3 0 <= 0.9.7

References

https://github.com/wbond/pybars3/issues/88
issue-tracking
https://github.com/wbond/pybars3
product
https://github.com/vladko312/advisories/blob/702e98db9642...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vladislav Korchagin
.