Quick answers
- Is CVE-2026-35477 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35477 being exploited in the wild.
- How severe is CVE-2026-35477?
- Medium severity, with a CVSS score of 5.5, published 8 April 2026.
- Which products and versions are affected?
- InvenTree InvenTree 1.2.3 to 1.2.6.
- Is there a fix for CVE-2026-35477?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-35477 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-35477?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in InvenTree versions 1.2.3 through 1.2.6. While the PART_NAME_FORMAT validator was previously updated to use Jinja2's SandboxedEnvironment, the actual rendering logic in part/helpers.py continued to use the standard, non-sandboxed jinja2.Environment. Furthermore, the validator uses a dummy Part instance with a null primary key, allowing attackers to use conditional logic to bypass validation while executing malicious code during production rendering. An attacker with staff-level privileges and settings access can exploit this to achieve remote code execution. The issue is resolved in versions 1.2.7 and 1.3.0 by ensuring the renderer uses the SandboxedEnvironment and hardening the validator.
Affected products
- InvenTree InvenTree 1.2.3 to 1.2.6
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: NVD publication date