SZB-756dcd5869
pybars4 discloses CVE-2026-119717, a code injection flaw in Handlebars template handling
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- pybars4
- Product
- pybars4
- First seen
Summary
The Hacker Wire's advisory, as relayed on Mastodon, describes a code injection vulnerability in pybars4 through 0.9.13 that is scored High (8.1). The item says attackers could execute Python code through unescaped bracketed path segments in Handlebars templates.
If you use pybars4
Upgrade pybars4 to a version newer than 0.9.13 once a fix is published
Do not render Handlebars templates from untrusted sources
Check the project's repository or advisory for the patched release
What the sources say 1
· Mastodon: “pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_ https:// compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates.” Source