Pybars3
Monthly
Code injection in pybars3 through 0.9.7 lets anyone who can control the body of a Handlebars template escape the string literals emitted by pybars/_compiler.py and run arbitrary Python inside the host application process. The decisive exposure factor is deployment design: applications that only render trusted, developer-authored templates and pass untrusted values as runtime context data are not exposed, while applications that accept untrusted users' template source (an SSTI-style design) are. Impact is rated critical in the CVSS 4.0 vector (VC:H/VI:H/VA:H) but is gated by high attack complexity and a present attack prerequisite, no CISA KEV listing or confirmed working exploit code was identified at time of analysis, and the vuln.today decision label is monitor.
Code injection in pybars3 through 0.9.7 lets anyone who can control the body of a Handlebars template escape the string literals emitted by pybars/_compiler.py and run arbitrary Python inside the host application process. The decisive exposure factor is deployment design: applications that only render trusted, developer-authored templates and pass untrusted values as runtime context data are not exposed, while applications that accept untrusted users' template source (an SSTI-style design) are. Impact is rated critical in the CVSS 4.0 vector (VC:H/VI:H/VA:H) but is gated by high attack complexity and a present attack prerequisite, no CISA KEV listing or confirmed working exploit code was identified at time of analysis, and the vuln.today decision label is monitor.