Live › vulnerability › CVE-2026-119717
pybars4 is a Python library that renders Handlebars templates; through version 0.9.13, unescaped bracketed path segments let a template break out of generated code and execute Python in the host process. An attacker who can supply or influence a template can run arbitrary code as the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Applications that use pybars4 to compile Handlebars templates are exposed, most dangerously where templates or helper or block arguments come from untrusted users. Applications that only render fixed, developer-written templates with no user-controlled input are less exposed. The sources do not describe further conditions.
No product ranges from the sources yet.
pip show pybars4 and look for versions up to 0.9.13.requirements.txt, poetry.lock, Pipfile.lock) for pybars4.0.9.13 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119717")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.