CVE-2026-119716

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to...