CVE-2026-35477 is a template injection flaw in InvenTree, the open source inventory system, scored 5.5 (Medium) in the CVE record. The part name format setting is validated in a sandbox but rendered outside one. Versions 1.2.7 and 1.3.0 fix it.
What's affected
- Product: InvenTree
- Affected versions: 1.2.3 to 1.2.6
- Fixed versions: 1.2.7 and 1.3.0
- Condition: a staff user with access to settings
The GitHub advisory says the issue needs a user with granted staff permissions. It follows an earlier fix for CVE-2026-27629 that was incomplete. The record does not say the flaw is exploited in the wild, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the version in the InvenTree web interface, or the image tag if you run containers.
docker image ls | grep -i inventree
If the version is between 1.2.3 and 1.2.6, you are affected. Then list which accounts have staff rights and settings access. Those are the people who could edit the part name format setting.
What to do now
- Upgrade to InvenTree 1.2.7 or 1.3.0.
- Review staff accounts and remove settings access from anyone who does not need it.
- If you cannot upgrade, the advisory workaround is to override the PART_NAME_FORMAT setting at the system level to a default value, so it cannot be edited from the interface. That needs system administrator access.
- Check the setting value now for anything beyond a plain format string.
Why it matters
The record files this under CWE-1336, improper neutralization of special elements in a template engine. The advisory explains two gaps. The checker used a sandboxed template environment, but the code that renders names used a plain one. The checker also used a dummy part with no ID, so a conditional expression could pass the check and behave differently later.
The lesson is general. If a safety check and the real code path are not the same code, they will drift apart. Sandboxing only protects what actually runs inside it.
Quick check
Who can use this flaw?
Per the advisory, a staff user with access to settings. It is not open to anonymous visitors.
What is the workaround?
Override PART_NAME_FORMAT at the system level to a default, so it cannot be edited from the interface. That takes system administrator access.
Sources
Last reviewed: 19 October 2026.
