SZB-f2f0be3ada
EUVD-2026-114122 lists code injection flaw in pybars4 through 0.9.13
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- up9inc
- Product
- pybars4
- First seen
Summary
The EUVD listing, shared on Mastodon, describes a code injection vulnerability in pybars4 through 0.9.13 with a CVSS v3.1 score of 9.2. It says attackers can execute Python code through crafted Handlebars template path segments.
If you use up9inc
Upgrade pybars4 to a release later than 0.9.13
Audit Handlebars templates for untrusted or crafted path segments
Limit template sources to trusted input until patched
What the sources say 1
· Mastodon: “pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_ https:// compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates.” Source