CVE-2026-46439

A flaw was found in compliance-trestle. This Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command, which recursively evaluates rendered templates. An attacker can inject malicious payloads into data fields, such as SSP documents or Lookup Tables, to achieve...

CVE-2026-33154

Report sulla Vulnerabilità SSTI in Dynaconf Riepilogo Dynaconf è vulnerabile a Server-Side Template Injection SSTI a causa della valutazione non sicura dei template nel resolver @Jinja. Quando il pacchetto jinja2 è installato, Dynaconf valuta le espressioni di template incorporate nei valori di...

CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

The vulnerable code output_file = trestle_root / r_output_file in trestle/core/commands/author/jinja.py accepts unvalidated -o/--output paths, enabling ../, ..\, or absolute path traversal. Exploitation is trivial (single command, no auth) and can overwrite .github/workflows/*.yml, .git/hooks/*, ...

CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2026-46439

CVE-2026-46439 (compliance-trestle SSTI): A Server-Side Template Injection exists in the TreSTLE tool when running the command trestle author jinja. The vulnerability arises from recursive re-rendering of data-bound templates, allowing an attacker-controlled payload embedded in SSPs or Lookup Tab...

EUVD-2026-57219

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-73374

CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...

CVE-2026-73374 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-73374

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

PT-2026-71082

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the render tag badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the...

CVE-2026-71446

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

DEBIAN-CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

UBUNTU-CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

CVE-2026-18581 ggml-org llama.cpp Jinja Minja Template parser.cpp assertion

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...