CVE-2026-5559
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In PyBlade versions 0.1.8-alpha and 0.1.9-alpha, the function _is_safe_ast in sandbox.py (AST Validation component) improperly neutralizes special elements used in a template engine. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An organization using PyBlade is at risk of remote code execution in the template engine, potentially leading to application compromise.
Recommendation
Immediately stop using PyBlade versions 0.1.8-alpha and 0.1.9-alpha, and monitor the project repository for an official patch.
Original NVD description (English source)
A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function _is_safe_ast of the file sandbox.py of the component AST Validation. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.