CVE-2026-119716

Name of the Vulnerable Software and Affected Versions pybars3 versions 0.1.0 through 0.9.7

Description A code injection issue exists in the template compiler within the pybars/ compiler.py file. Template authors can execute arbitrary Python code in the application process by providing crafted Handlebars templates. This is achieved through unescaped bracketed path segments in helper or block arguments, which allow an attacker to break out of string literals.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.