CVE-2026-119717: pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

Published Oct 30, 2026

Updated

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.

Other sources

Rejected reason: This CVE ID has been rejected as a duplicate.

— NVD

Event History

Oct 30, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Should this CVE be used for tracking or remediation decisions?

No. The CVE record states that it has been rejected as a duplicate, so teams should identify and track the duplicate record rather than rely on this ID as the authoritative vulnerability record.

What application condition would make exploitation possible?

An attacker would need to be able to supply a Handlebars template containing a crafted bracketed path segment in a helper or block argument. The vulnerable compiler can incorporate that segment into a generated resolve() string literal, allowing Python code execution in the application process.

CVE-2026-119717: pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

Other sources

Event History

Frequently Asked Questions

Should this CVE be used for tracking or remediation decisions?

What application condition would make exploitation possible?

Company

Resources

Contact

Frequently Asked Questions

Should this CVE be used for tracking or remediation decisions?

What application condition would make exploitation possible?