CVE-2026-96795

Received Received - Intake

Arbitrary Code Execution in Horilla HR and CRM Software

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-96795

Affected Vendors & Products

Vendor	Product	Version / Range
horilla	horilla	to 2.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Horilla, an HR and CRM software, prior to version 2.0.0. The issue is in the HorillaListView.export_data function which improperly handles a user-controlled 'columns' POST parameter. The function takes a user-supplied value, interpolates it into a Python source string, and executes it using the 'exec()' function. This allows an attacker to inject malicious Python code that can execute arbitrary operating system commands with the privileges of the application process, including root privileges in the default Docker setup.

Detection Guidance

To detect this vulnerability, inspect network traffic for POST requests to HorillaListView.export_data with a columns parameter containing suspicious payloads. Check application logs for exec() calls with dynamic function definitions. Search for unauthorized command execution patterns in system logs.

Impact Analysis

If exploited, this vulnerability allows an authenticated attacker to execute arbitrary commands on the server running Horilla. This could lead to complete system compromise, data theft, unauthorized access to sensitive information, or disruption of services. Attackers could install malware, modify or delete data, or pivot to other systems within the network.

Compliance Impact

This vulnerability severely impacts compliance with GDPR and HIPAA by enabling unauthorized access to sensitive personal data. GDPR requires protection of personal data and breach notification within 72 hours; this flaw could lead to unauthorized data exposure violating those requirements. HIPAA mandates strict access controls for protected health information; exploitation could result in unauthorized access or disclosure, leading to compliance violations and significant penalties.

Mitigation Strategies

Immediately upgrade Horilla to version 2.0.0 or later. If upgrading is not possible, disable the affected export_data functionality or restrict access to authenticated users with minimal privileges. Monitor for signs of exploitation and apply network-level protections.

Hi! I’m here to help you understand CVE-2026-96795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70