pybars4: Code injection in pybars/_compiler.py (CVE-2026-119717)
The pybars4 library through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows execution of Python code via unescaped bracketed path segments in Handlebars templates.
CVE search metadata
CVE search record: CVE-2026-119717. Severity: high. CVSS: 8.1. KEV: no. Product: pybars4 (<= 0.9.13). Brief: pybars4: Code injection in pybars/_compiler.py (CVE-2026-119717). Brief link: https://feed.craftedsignal.io/briefs/2026-10-pybars4-code-injection/
Triage facts
Revision 1- Applicability
- pybars4 (<= 0.9.13)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 17:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-119717 identifies a code injection vulnerability in pybars4 through 0.9.13. The flaw exists in 'pybars/_compiler.py'. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated 'resolve()' string literal and execute Python code in the application process.