pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 9.2 · wbondNVD modified 2026-10-30 15:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/wbond/pybars3/issues/88 issue-tracking
- https://github.com/wbond/pybars3 product
- https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md third-party-advisory
- https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160 technical-description
- https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-path-segments third-party-advisory