Is CVE-2026-35477 actively exploited?

No active exploitation of CVE-2026-35477 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-35477 be exploited remotely?

Yes. CVE-2026-35477 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-35477?

CVE-2026-35477 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-35477

MEDIUM

CVE-2026-35477

CWE-1336Published: April 8, 2026· Updated: Apr 8, 2026

5.5

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.9th

Official Description

InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.

NVD Source

Technical Analysis

CVE-2026-35477 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.