CVE-2026-119717
Received Received - Intake

Code Injection in pybars4 via Handlebars Template

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119717
EUVD
EUVD-2026-114122

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
up9inc pybars4 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

pybars4 through 0.9.13 has a code injection flaw in pybars/_compiler.py. Attackers can execute Python code by inserting unescaped bracketed path segments in Handlebars templates. Crafted segments in helper or block arguments allow breaking out of the resolve() string literal, enabling code execution in the application process.

Impact Analysis

This vulnerability allows attackers to run arbitrary Python code on systems using vulnerable versions of pybars4. This could lead to unauthorized data access, system compromise, or further network infiltration depending on the application's context and permissions.

Mitigation Strategies

Update pybars4 to version 0.9.14 or later to patch the code injection vulnerability. Review Handlebars templates for unescaped bracketed path segments in helper or block arguments. Implement input validation and sanitization for user-supplied templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart