CVE-2026-79310

Name of the Vulnerable Software and Affected Versions web.py version 0.76

Description Server-side template injection (SSTI) occurs when the template engine is tricked into executing attacker-controlled template code, bypassing built-in security checks. This happens when an application precompiles templates from a directory that an attacker can write to and subsequently renders them through the precompiled template loader. This sandbox bypass allows for arbitrary Python code execution and OS command execution on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.