CVE-2026-119716
Last modified
CVE-2026-119716 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process..
Description
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| wbond | pybars3 | <= 0.9.7 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-119716?
How severe is CVE-2026-119716?
How do I fix CVE-2026-119716?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-119710PipesHub 0.3.0 before 0.10.0 contains an event type injectio…7.1
- CVE-2026-119711PipesHub before 0.10.0 contains a rate limit bypass vulnerab…5.3
- CVE-2026-119712PipesHub before 0.10.0 contains a server-side request forger…6.4
- CVE-2026-119713Paperclip 2026.403.0 before 2026.416.0 contains a remote cod…8.8
- CVE-2026-119714My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a …6.5
- CVE-2026-119715NocoDB before 2026.08.0 contains a clickjacking vulnerabilit…4.3
- CVE-2026-119717pybars4 through 0.9.13 contains a code injection vulnerabili…8.1
- CVE-2026-119718Blender before 4.5.15 and 5.x before 5.2.3 contains a heap b…7.8
- CVE-2026-119719Blender before 4.5.15 and 5.x before 5.2.3 contains a heap b…7.8
- CVE-2026-11972When using the "tarfile" module with a file opened in "strea…8.2
- CVE-2026-119720Blender before 4.5.15 and 5.x before 5.2.3 contains a heap o…5.5
- CVE-2026-119721Blender before 4.5.15 and 5.x before 5.2.3 contains an out-o…6.1
Are you affected by CVE-2026-119716?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST