CVE-2026-96795

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0

Description An issue exists in the export data function within the HorillaListView class located in horilla views/generic/cbv/views.py. The application accepts a columns POST parameter from an authenticated user, extracts field tuple[1], and interpolates it into dynamic fn str as Python source code, which is then passed to the exec() function. A specially crafted string that remains valid under ast.literal eval can inject Python syntax into a default argument evaluated during function definition. This allows for the execution of arbitrary operating-system commands with the privileges of the application process, which may include root privileges when using the provided Docker image.

Recommendations Update to version 2.0.0.