Live › vulnerability › CVE-2026-119716
pybars3 through 0.9.7 does not escape bracketed path segments in templates, so a template author can break out of string literals. An attacker who supplies a crafted Handlebars template gets Python code execution inside the application process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Applications that install pybars3 up to 0.9.7 and let untrusted parties author or edit the Handlebars templates they render are exposed. Projects that only render their own fixed templates, with no user-supplied template text, are less exposed but should still upgrade when a fixed version is available.
No product ranges from the sources yet.
pybars3 (for example pip show pybars3 or the lock file) and note the installed version.pybars3 past 0.9.7; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119716")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.