---
id: CVE-2026-119716
title: >-
  pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed
  Path Segments
summary: >-
  pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection
  vulnerability in pybars/_compiler.py that allows template authors to execute
  Python code via unescaped bracketed path segments. Attackers can supply
  Handlebars tem…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: wbond
product: pybars3
affected:
  - pybars3 <= 0.9.7
  - pybars4 <= 0.9.13
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T20:53:40.920Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119716'
references:
  - url: 'https://github.com/wbond/pybars3/issues/88'
    label: 'GitHub Issue #88'
  - url: 'https://github.com/wbond/pybars3'
  - url: 'https://github.com/up9inc/pybars4'
  - url: >-
      https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md
  - url: 'https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160'
  - url: >-
      https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_compiler.py#L153-L154
  - url: >-
      https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-path-segments
    label: >-
      VulnCheck Advisory: pybars3 through 0.9.7 Code Injection via Bracketed
      Path Segments
tags:
  - cve.org
epss: 0.00458
epssPercentile: 0.39815
ingestedAt: '2026-11-05T19:30:42.847Z'
---

## Overview

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

## Affected

- `pybars3 <= 0.9.7`
- `pybars4 <= 0.9.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.