{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pybars4--0.9.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-119717"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pybars4 (\u003c= 0.9.13)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-119717 identifies a code injection vulnerability in pybars4 through 0.9.13. The flaw exists in 'pybars/_compiler.py'. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated 'resolve()' string literal and execute Python code in the application process.\u003c/p\u003e\n","date_modified":"2026-10-30T17:37:21Z","date_published":"2026-10-30T17:37:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pybars4-code-injection/","summary":"The pybars4 library through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows execution of Python code via unescaped bracketed path segments in Handlebars templates.","title":"pybars4: Code injection in pybars/_compiler.py (CVE-2026-119717)","url":"https://feed.craftedsignal.io/briefs/2026-10-pybars4-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Pybars4 (\u003c= 0.9.13)","version":"https://jsonfeed.org/version/1.1"}