CVE-2026-96795 horilla CVE debrief

Who should care

Defenders responsible for Horilla HR and CRM software deployments should assess exposure and prioritize remediation. This includes reviewing system configurations, monitoring for potential exploitation attempts, and applying patches or upgrades as needed.

Why it matters

CVE-2026-96795 is a high-severity vulnerability in Horilla HR and CRM software that allows for arbitrary operating-system command execution. Defenders should prioritize remediation by upgrading to version 2.0.0 or applying patches, and review system configurations for potential exposure.

• Potential for arbitrary operating-system command execution with application process privileges
• Possible elevation of privileges to root in the shipped Docker image
• Need for verification of affected versions and exposure
• Priority for upgrading to version 2.0.0 or applying patches

Technical summary

The HorillaListView.export_data function in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter and interpolates it into a dynamic function definition using exec(). A crafted string can inject Python syntax into a default argument, allowing arbitrary operating-system commands to execute with application process privileges. This issue is fixed in version 2.0.0, which removes the vulnerability by properly validating user input. Defenders should prioritize upgrading to version 2.0.0 or applying available patches.

Defensive priority

Defenders should prioritize upgrading to version 2.0.0 or applying available patches. Systems using the affected versions should be reviewed for potential exposure.

Recommended defensive actions

• Upgrade to version 2.0.0 or apply available patches
• Review systems using affected versions for potential exposure
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and the affected software versions. The vulnerability exists in Horilla HR and CRM software prior to version 2.0.0. Evidence is based on CVE and NVD data, which may have limitations. Defenders should verify affected versions, review system configurations, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.