Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119716pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

Critical 9.8

In plain English

A critical-severity code injection in pybars4 from up9inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

Affected products (as reported)

Vendor	Product	Versions
wbond	pybars3	0 – through 0.9.7
up9inc	pybars4	0 – through 0.9.13

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Issue #88 issue-tracking
https://github.com/wbond/pybars3 product
https://github.com/up9inc/pybars4 product
https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md third-party-advisory
https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160 technical-description
https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_compiler.py#L153-L154 technical-description
VulnCheck Advisory: pybars3 through 0.9.7 Code Injection via Bracketed Path Segments third-party-advisory