External risk intelligence

pybars4 Code Injection via Crafted Template Path Segments

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-119717

The vulnerability exists in pybars4, a Python library for Handlebars templates. While it can be used in internet-facing web applications to render dynamic content, it is a library integrated into custom application code rather than a standalone network service or appliance. Exposure depends entirely on whether a specific application uses the library to process untrusted user-supplied templates.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a code injection vulnerability found in the pybars4 library, which is used for templating. The flaw allows an attacker to potentially execute arbitrary Python code if specific template segments are crafted in a particular way. The main concern is confirming if this library is used within our systems and if it processes untrusted input through templates.

Code can be injected via special templates.
Confirms if library is used, and how.
Assess relevance to business operations.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by supplying specially crafted Handlebars templates to an application that uses the pybars4 library. If the application processes these templates without proper sanitization, the attacker's code, embedded within path segments, can be injected and executed with the privileges of the application itself. This allows for arbitrary Python code execution within the application's environment.

Internet-facing applications processing templates.
Crafted template segments in helper or block arguments.
Arbitrary Python code execution in application process.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary Python code within the application process when it processes specially crafted Handlebars templates. This may occur when the application uses the affected library to render templates that include unescaped, bracketed path segments in helper or block arguments, potentially impacting the application's behavior and underlying system.

Application code execution.
Unescaped template segments.
System compromise or data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners are primarily responsible for addressing this code injection vulnerability in pybars4, as it resides within their custom codebases. Infrastructure and platform teams should be engaged to understand the deployment context and potential blast radius. The first practical step is to identify all instances where pybars4 is used, determine if those applications process untrusted input via Handlebars templates, and assess business criticality before planning remediation.

Application owners must identify usage.
Verify template processing of untrusted input.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the pybars4 library?

pybars4 is a Python implementation of the Handlebars templating language. Developers use it to build dynamic web pages or generate structured text output by combining static templates with data. It serves as an engine within custom applications to render content before it reaches the end user.

What does code injection mean for CVE-2026-119717?

This vulnerability involves Improper Control of Generation of Code (CWE-94). It means the library fails to properly handle input within template segments. Because the compiler does not safely treat these segments as data, an attacker can trick the library into running unauthorized Python commands within the application's process.

How does an attacker trigger this vulnerability?

An attacker must provide a specially crafted Handlebars template to an application using the affected library. The vulnerability is triggered when the template contains unescaped, bracketed path segments within helper or block arguments. If the template uses only standard, trusted content, this specific code execution path is not triggered.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal labels this as external because pybars4 can be integrated into internet-facing web applications. If your application accepts templates directly from users, the risk is higher. However, since pybars4 is a library rather than a standalone network service, your specific exposure depends entirely on how your internal code handles untrusted input.

What are the first steps to address this CVE?

Start by identifying all applications in your environment that rely on the pybars4 library. Once located, verify if those applications process Handlebars templates provided by users or external sources. If they do, prioritize these systems for review to determine if the templates are properly sanitized before they reach the library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.