SZB-b3bbb6c22b
pybars3 discloses CVE-2026-119716, a code injection flaw in template path handling
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- pybars3
- Product
- pybars3
- First seen
Summary
The Hacker Wire's advisory, as relayed on Mastodon, describes a code injection vulnerability in pybars3 through 0.9.7 that is scored High (8.1). The item says template authors could execute Python code via unescaped bracketed path segments.
If you use pybars3
Upgrade pybars3 to a version newer than 0.9.7 once a fix is available
Review Handlebars templates for untrusted or user-supplied content
Check the project's repository or advisory for the patched release
What the sources say 1
· Mastodon: “pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_ https:// compiler.py that allows template authors to execute Python code via unescaped bracketed path segments.” Source