Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M

CVE-2026-96795Horilla: Authenticated RCE in Horilla List-View Export

High 8.8

In plain English

A high-severity code injection in horilla-hr from horilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

Affected products (as reported)

Vendor	Product	Versions
horilla	horilla-hr	< 2.0.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/horilla/horilla-hr/security/advisories/GHSA-5g4v-4rv4-r26f x_refsource_CONFIRM
https://github.com/horilla/horilla-hr/releases/tag/2.0.0 x_refsource_MISC