Horilla HR CVE-2026-96795

Requires a valid authenticated Horilla account with permission to reach HorillaListView.export_data (list/export functionality); the attacker submits a crafted 'columns' POST parameter whose field_tuple[1] value remains valid under ast.literal_eval while injecting Python into a default argument evaluated at function definition. No non-default configuration is needed and no user interaction is required. Exploitation is limited only by the need for authentication (PR:L); impact is amplified in the shipped horilla/horilla-hr Docker image, which runs the process as root, so commands execute with root privileges. Affects all versions prior to 2.0.0.

This is a genuine high-priority vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity code injection requiring only a low-privileged authenticated account and no user interaction, yielding full confidentiality, integrity, and availability impact via arbitrary OS command execution (CWE-94). The vector is internally consistent with the description: an authenticated user submits a crafted 'columns' POST parameter that is interpolated into Python source and passed to exec(). Exploitation status is 'no public exploit identified at time of analysis' for weaponized code - KEV is not listed and no EPSS score was provided in the input, so widespread automated exploitation cannot be asserted; however a VulDB advisory entry exists (vuldb.com/vuln/410491) alongside the GitHub Security Advisory (GHSA-5g4v-4rv4-r26f). The one factor that meaningfully raises real-world impact is deployment context: the shipped Docker image runs the application as root, so successful RCE grants root on the container. The main dampener is the PR:L requirement - an attacker needs a valid application account - which makes this most dangerous for multi-tenant or employee-facing HR deployments where low-privilege accounts are common. No signals conflict; the primary missing data are EPSS probability and a confirmed public POC.

A low-privileged but authenticated Horilla user (e.g., a regular employee account) invokes a list export and submits a crafted 'columns' POST parameter whose field value stays valid under ast.literal_eval while injecting Python syntax into a default argument evaluated when the dynamically generated function is defined via exec(). This executes attacker-chosen OS commands with the application process's privileges - root inside the shipped Docker image. No public weaponized exploit is identified at time of analysis, though a VulDB advisory and GitHub Security Advisory document the flaw.