The vulnerability, classified as CWE-94, allows anyone able to supply a Handlebars template to inject and execute arbitrary Python code within the application process. The flaw arises in pybars3’s compiler module where bracketed path segments are not properly escaped, enabling crafted segments in helper or block arguments to break out of intended string literals. Because the injected code runs with the privileges of the host application, successful exploitation would grant full system control, representing a critical security risk.

The affected product is pybars3 version 0.9.7 and earlier releases from wbond. The vulnerability is present in the compiler’s handling of bracketed path segments in all builds that include this module, so any Python application using pybars3 to render templates is vulnerable. The impact is confined to environments that accept user‑supplied Handlebars templates.

The CVSS score of 9.2 indicates critical severity, and the vulnerability is currently not listed in the CISA KEV catalog. The EPSS score is not available, so the precise likelihood of exploitation is unknown; however, the nature of the flaw—executable code injection from templates—makes it highly attractive to attackers who can influence template content. In practice, any party that can deliver a template is able to trigger the injection, meaning the attack vector is local to the application’s template‑accepting interface but can lead to system‑wide compromise.