Executive brief
AntaresMugisho PyBlade is a Python template engine used to create dynamic web content. A security flaw in how the engine processes user-provided templates allows an attacker to bypass safety restrictions and execute unauthorized code on the server. This could lead to a complete system takeover, unauthorized access to sensitive data, or disruption of services.
Technical details
PyBlade versions 0.1.8-alpha through 0.2.0-alpha are vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE). In versions 0.1.8-alpha and 0.1.9-alpha, the '_is_safe_ast' function in 'sandbox.py' fails to validate 'ast.Constant' nodes, allowing attackers to access Python magic methods (e.g., '__class__') via string constants. In version 0.2.0-alpha, the 'evaluator.py' component uses the 'eval()' function directly without any AST validation. A remote attacker with the ability to provide template input can leverage these flaws to escape the sandbox and execute arbitrary Python code. A fix has been identified in commit 62c95c47 which introduces a proper AST-based SafeEvaluator.
Affected products
- AntaresMugisho PyBlade 0.1.8-alpha to 0.2.0-alpha
Timeline
- 2026-02-24: patched: Fix introduced in commit 62c95c47
- 2026-03-17: disclosed: Issue reported on GitHub repository
- 2026-04-05: advisory: NVD/VulDB advisory published