Code Injection Vulnerability in pybars4 by UP9 Inc.
CVE-2026-119717

9.2CRITICAL

Key Information:

Vendor

Up9inc

Status
Pybars4
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119717?

The pybars4 library, through version 0.9.13, is susceptible to a code injection issue located in the pybars/_compiler.py file. This vulnerability allows attackers to manipulate Handlebars templates by inputting unescaped bracketed path segments. By exploiting this flaw, an attacker can craft a template segment in a helper or block argument, leading to the execution of arbitrary Python code within the application's process, thereby compromising system security.

Affected Version(s)

pybars4 0 <= 0.9.13

References

https://github.com/vladko312/advisories/blob/702e98db9642...
third-party-advisory
https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_com...
technical-description
https://github.com/up9inc/pybars4
product

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vladislav Korchagin
.