Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119717— pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

Quick assessment

Affected
up9inc pybars4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pybars4 版本 0.9.13 及更早版本在 中存在代码注入漏洞。攻击者可通过 Handlebars 模板中未转义的带括号路径片段，执行任意 Python 代码。具体而言，攻击者可构造包含恶意片段的辅助函数（helper）或块参数（block argument），从而突破生成的 字符串字面量限制，进而在应用程序进程中执行恶意代码。

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
up9inc pybars4 ≤ 0.9.13 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119717

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
Source: CVE Program / CVE List V5
Vulnerability Description
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
up9inc pybars4 0 ~ 0.9.13 -

II. Public POCs for CVE-2026-119717

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119717

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119717 (1)

Vendor Advisories for CVE-2026-119717 (1)

Vendor Pages for CVE-2026-119717 (2)

IV. Related Vulnerabilities

Same weakness: CWE-94