EUVD Vulnerability Catalog
EUVD-2026-114122
Severity: CRITICAL
Base Score: 9.2
CVSS Version: 4.0
Vulnerability Description
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): High
▪
Attack Requirements (AT): Present
▪
Privileges Required (PR): None
▪
User Interaction (UI): None
▪
Vulnerability Confidentiality Impact (VC): High
▪
Vulnerability Integrity Impact (VI): High
▪
Vulnerability Availability Impact (VA): High
▪
Subsequent Confidentiality Impact (SC): None
▪
Subsequent Integrity Impact (SI): None
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
up9inc
References & Advisory Links
- https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md
- https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_compiler.py#L153-L154
- https://github.com/up9inc/pybars4
- https://www.vulncheck.com/advisories/pybars4-through-0.9.13-code-injection-via-bracketed-path-segments
- https://nvd.nist.gov/vuln/detail/CVE-2026-119717
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
VulnCheck
EPSS Probability
0
Known Aliases
CVE-2026-119717
GHSA-x54v-7mw2-5rrx
Published On
2026-10-30
Last Updated
2026-10-30