https://feed.craftedsignal.io/products/pybars4--0.9.13/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:37:21 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-pybars4-code-injection/Fri, 30 Oct 2026 17:37:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-pybars4-code-injection/The pybars4 library through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows execution of Python code via unescaped bracketed path segments in Handlebars templates.<p>CVE-2026-119717 identifies a code injection vulnerability in pybars4 through 0.9.13. The flaw exists in 'pybars/_compiler.py'. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated 'resolve()' string literal and execute Python code in the application process.</p> highadvisory