PT-2026-31434 · Inventree · Inventree

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-35477

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InvenTree versions 1.2.3 through 1.2.6

Description InvenTree, an Open Source Inventory Management System, has an issue where a staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This occurs because the PART NAME FORMAT validator was upgraded to use a sandboxed Jinja2 environment, but the renderer in part/helpers.py still uses a non-sandboxed environment. The validator also uses a dummy Part instance with a primary key of None, causing conditional template expressions to behave differently during validation and production rendering.

Recommendations Update to version 1.2.7 or 1.3.0

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-35477

Affected Products

Inventree

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35477 · Security Note
• https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq · Note
• https://twitter.com/VulmonFeeds/status/2042008787775521062 · Twitter Post
• https://t.me/CVEtracker/50085 · Telegram Post