{
  "affected": [
    {
      "affectedData": [
        {
          "product": "InvenTree",
          "vendor": "inventree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.2.3, \u003c 1.2.7"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0B83810-7753-42DE-8C65-7762037BC687",
              "versionEndIncluding": "1.2.6",
              "versionStartIncluding": "1.2.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0."
    },
    {
      "lang": "es",
      "value": "InvenTree es un Sistema de Gesti\u00f3n de Inventario de C\u00f3digo Abierto. Desde 1.2.3 hasta 1.2.6, la correcci\u00f3n para CVE-2026-27629 actualiz\u00f3 el validador PART_NAME_FORMAT para usar jinja2.sandbox.SandboxedEnvironment. Sin embargo, el renderizador real en part/helpers.py no fue actualizado y a\u00fan usa el jinja2.Environment no-sandboxed. Adem\u00e1s, el validador usa una instancia \u0027dummy\u0027 de Part con pk=None, lo que permite que las expresiones de plantilla condicionales se comporten de manera diferente durante la validaci\u00f3n en comparaci\u00f3n con la renderizaci\u00f3n en producci\u00f3n. Un usuario del personal con acceso a la configuraci\u00f3n puede crear una plantilla que pasa la validaci\u00f3n pero ejecuta c\u00f3digo arbitrario durante la renderizaci\u00f3n. Este problema requiere acceso por parte de un usuario con permisos de personal concedidos. Esta vulnerabilidad se corrige en 1.2.7 y 1.3.0."
    }
  ],
  "id": "CVE-2026-35477",
  "lastModified": "2026-07-24T21:10:00.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-35477",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-10T20:43:01.777985Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-08T20:16:24.487",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}