CVE-2026-96795

8.8 HIGHpublic exploit available

Published 2026-09-25 · Updated 2026-09-28

AI risk analysis

Summary: The flaw allows an attacker to inject arbitrary Python code, leading to remote code execution with the application process privileges, including potential root access.
Exploitability: Exploitation requires an authenticated user with the ability to manipulate the columns POST parameter. The attacker must craft a specific payload that can bypass validation and execute arbitrary commands.
Blast radius: If exploited, the impact could be severe, as it allows execution of arbitrary commands with potentially elevated privileges, affecting the entire system.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Horilla version 2.0.0 or later.

rcewebpythonarbitrary-code-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.