CVE-2026-35477 InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape

Medium 5.5 Published 8 Apr 2026 Updated 10 Apr 2026

A staff user can execute arbitrary code via Server-Side Template Injection in InvenTree due to inconsistent sandboxing between validation and rendering.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-35477?

CVE-2026-35477 is a medium-severity code injection vulnerability in InvenTree, published on 8 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.

Weakness: CWE-1336

Which versions are affected by CVE-2026-35477?

It affects 1 product.

Products include Inventree Project Inventree.

How do I fix CVE-2026-35477?

No fix has been published for CVE-2026-35477 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-35477 being exploited?

There is no known exploitation of CVE-2026-35477 in the wild and no public exploit code.

Sources

Also known as GHSA-84jh-x777-8pqq.