Web.py 0.76 contains a server‑side template injection flaw that allows attackers to trick the built‑in template engine into executing arbitrary Python code. By inserting malicious template expressions, the safeguard designed to reject such code can be bypassed; executing the template through the precompiled loader then causes the injected code to run, which can lead to OS command execution and full compromise of the host system.

The vulnerability is limited to applications that use web.py 0.76 and enable precompilation of templates from directories that an attacker can write to. No additional vendor or product information is available, so the impact applies only to custom deployments that meet these conditions.

A remote attacker can exploit the flaw by sending a crafted HTTP request that writes a malicious template file to a writable template directory and then triggers its rendering. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the potential for arbitrary code execution makes the risk very high. The likely attack vector is the network‑based HTTP request that feeds both the template creation and execution processes.