Open Source Inventory Management System Vulnerability in InvenTree
CVE-2026-35477

5.5MEDIUM

Key Information:

Vendor

Inventree

Status
Inventree
Vendor
CVE Published:
8 April 2026

What is CVE-2026-35477?

InvenTree, an Open Source Inventory Management System, contains a vulnerability that allows a staff user with specific permissions to craft misleading templates. Although the PART_NAME_FORMAT validator was updated to enhance security by using jinja2.sandbox.SandboxedEnvironment, the rendering engine remains vulnerable due to its reliance on the non-sandboxed jinja2.Environment. This discrepancy permits crafted templates to pass validation while potentially executing arbitrary code during actual rendering, emphasizing the need for users to upgrade to versions 1.2.7 or 1.3.0 where the issue has been resolved.

Affected Version(s)

InvenTree >= 1.2.3, < 1.2.7

References

https://github.com/inventree/InvenTree/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.