CVE-2024-41950 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

2024-07-3115:50:59

CWE-1336

GitHub_M

www.cve.org

cve-2024-41950

insecure jinja2 templates

haystack components

rce

haystack 2.3.1

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

10.7%

JSON

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. The vulnerability has been fixed with Haystack 2.3.1.

CNA Affected

[
  {
    "vendor": "deepset-ai",
    "product": "haystack",
    "versions": [
      {
        "version": "< 2.3.1",
        "status": "affected"
      }
    ]
  }
]