~ / search / GHSA-23jg-5f8m-gw8c

GHSA-23jg-5f8m-gw8c

PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py

Source: GitHub Advisory Database (reviewed) Low CVE-2026-5559

Packages

EcosystemPackageAffectedFixed in
PyPI pyblade >= 0.1.8-alpha, <= 0.2.0-alpha no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function _is_safe_ast of the file sandbox.py of the component AST Validation. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

External links from the advisory. They lead to third-party sites.