All vulnerabilities
CVE-2026-96795GHSA-5g4v-4rv4-r26f

horilla-hr: Horilla: Authenticated RCE in Horilla List-View Export

horilla horilla-hr
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.0Fixed versionGitHub
Published25 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 2.0.0https://github.com/horilla/horilla-hr, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a default argument evaluated during function definition, allowing arbitrary operating-system commands to execute with the application process privileges, including root privileges in the shipped Docker image. This issue is fixed in version 2.0.0.

Text from CVE List

Affected versions 2

  • horilla-hraffected: < 2.0.0CVE List
  • https://github.com/horilla/horilla-hr, other<= 1.6.1GitHub

References 2