SZB-1282b8c6a0
EUVD lists code injection in pybars3 through 0.9.7
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- wbond
- Product
- pybars3
- First seen
Summary
The EUVD entry EUVD-2026-114121 (CVSS v3.1 score 9.2) describes a code injection vulnerability in pybars3's compiler. According to the entry, template authors can execute Python code by using unescaped bracketed path segments in Handlebars templates.
If you use wbond
Upgrade pybars3 past version 0.9.7 once a fixed release is confirmed
Render only trusted templates until patched
Review template sources for unescaped bracketed path segments
What the sources say 1
· Mastodon: “pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_ https:// compiler.py that allows template authors to execute Python code via unescaped bracketed path segments.” Source