CVE-2026-96795: Horilla: Authenticated RCE in Horilla List-View Export
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple[1], interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literaleval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Horillato a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Horilla account and the ability to submit a crafted columns POST parameter to the list-view export functionality. No user interaction is required.
Are deployments running the shipped Docker image at greater risk?
Yes. The injected operating-system commands execute with the application process privileges, which can include root privileges in the shipped Docker image.
Which versions are affected and what is the remediation?
Horilla versions prior to 2.0.0 are affected. Upgrade to version 2.0.0, which fixes the issue.