CVE-2026-119716

The pybars3 library (versions through 0.9.7 ) is vulnerable to a code injection flaw located in pybars/_compiler.py. The root cause is the handling of unescaped bracketed path segments , which allows template authors to execute arbitrary Python code . By providing crafted segments within Handleba...

CVE-2026-119717

Versions pybars4 through 0.9.13 are vulnerable to a code injection flaw located in pybars/_compiler.py. The issue stems from the handling of unescaped bracketed path segments in Handlebars templates. An attacker can provide a template containing a crafted segment within a helper or block argument...

CVE-2026-119717 pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...