Threats tagged 'ghsa-8m9w-mh94-cwr6'

web.py version 0.76 and earlier is vulnerable to server-side template injection (SSTI) that allows attackers to execute arbitrary Python code and OS commands on the server. This occurs when templates are precompiled from a directory writable by an attacker, bypassing built-in sandbox security checks.