CVE-2026-35477
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
InvenTree from version 1.2.3 to 1.2.6 contains a remote code execution vulnerability. Although the template validator uses a sandbox, the renderer in part/helpers.py still uses a non-sandboxed environment, allowing a staff user to execute arbitrary code.
Risk Assessment
A user with settings access can execute arbitrary code on the server, potentially leading to full system compromise.
Recommendation
Update InvenTree to version 1.2.7 or 1.3.0.
Original NVD description (English source)
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.