pybars3: Code injection via bracketed path segments in templates
Summary
pybars3 through version 0.9.7 does not escape bracketed path segments (the [...] syntax) when it generates Python code from Handlebars templates. A template author can break out of a string literal and execute arbitrary Python code in the application process. The CVSS 4.0 vector shows no privileges and no user interaction are needed, but the attacker must be able to supply or edit template content.
Affected
- pybars3 0 to 0.9.7 (wbond), per the CVE record
- The related pybars4 fork is covered by CVE-2026-119717, not by this entry
Fixed in
Unknown. No fixed pybars3 release has been confirmed; the latest release found is 0.9.7.
Workaround
- No vendor workaround confirmed.
- Do not let untrusted users create or edit Handlebars templates.
- Review applications that accept user-defined templates, including admin and reporting features.
- Run template rendering with low privileges and restricted network access.
Exploitation
- No known exploitation in the wild found.
- A third-party advisory publishes a proof of concept for the related pybars4 fork; a public proof of concept for pybars3 is not confirmed.
Our recommendation
- Inventory systems for pybars3 (pip packages, containers, vendor appliances, SBOMs).
- Ask vendors whether their products embed pybars3 and when a fixed version will be available.
- Remove user control over templates wherever possible.
- Monitor the upstream issue and advisories for a fix and apply it promptly.
Research sources
- VulnCheck advisory: pybars3 through 0.9.7 Code Injection via Bracketed Path Segments www.vulncheck.com
- Third-party advisory by vladko312 (Pybars3 and Pybars4 code injection) github.com
- pybars3 GitHub issue #88 github.com
- pybars3 source code: _compiler.py (version 0.9.7) github.com
- pybars3 project repository github.com
- VulDB entry for pybars3 code injection vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:52.
Original description (NVD)
pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.
NVD references (5)
- https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md
- https://github.com/wbond/pybars3
- https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160
- https://github.com/wbond/pybars3/issues/88
- https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-path-segments
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.