The vulnerability resides in pybars4’s compiler, where bracketed path segments in a Handlebars template are not fully escaped. A crafted template can terminate a generated string literal and inject arbitrary Python code, allowing an attacker to execute code within the application’s process. The flaw is a classic code‑injection issue, categorized as CWE‑94. The impact is a full compromise of confidentiality, integrity, and availability of the host, as the attacker can run any Python code the application process can execute.

The affected vendor is Up9 Inc., with the pybars4 product impacted in all releases up to and including version 0.9.13. Applications that depend on these versions and render user‑supplied Handlebars templates are vulnerable to the exploitation described.

The CVSS score of 9.2 indicates a high severity. EPSS is not available, so the current data does not quantify exploitation probability, but the technical description suggests that a malicious template is sufficient to launch the attack. The vulnerability is not listed in the CISA KEV catalog, though the potential for remote code execution makes it a top‑priority risk. The likely attack vector is a remote injection of a crafted template through an API or web form that feeds data to pybars4 for rendering.