GHSA-23jg-5f8m-gw8c

Suggest an improvement
Source
https://github.com/advisories/GHSA-23jg-5f8m-gw8c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-23jg-5f8m-gw8c/GHSA-23jg-5f8m-gw8c.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-23jg-5f8m-gw8c
Aliases
Published
2026-04-05T12:30:25Z
Modified
2026-07-13T16:43:41Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py
Details

A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function _is_safe_ast of the file sandbox.py of the component AST Validation. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids":  [
        "CWE-791"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-08T00:06:47Z",
    "nvd_published_at":  "2026-04-05T11:16:55Z",
    "severity":  "LOW"
}
References

Affected packages

PyPI / pyblade

Package

Name
pyblade
View open source insights on deps.dev
Purl
pkg:pypi/pyblade

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.1.8-alpha
Last Affected
0.2.0-alpha

Affected versions

0.*
0.1.8
0.1.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-23jg-5f8m-gw8c/GHSA-23jg-5f8m-gw8c.json"