CVE-2026-82634

Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...

CVE-2026-82634

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint (file: print_format_generator.py). Low-privileged users with print permission on any document can supply raw Jinja template strings, enabling arbitrary SELECT statements against unrelated table...

EUVD-2026-68202

Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...

CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint

Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...

CVE-2026-82447

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2026-82447 Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

CVE-2026-82447 Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, which could potentially lead to Cross-Site Scripting XSS. The Jinja xmlattr filter can be...

CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

The vulnerable code output_file = trestle_root / r_output_file in trestle/core/commands/author/jinja.py accepts unvalidated -o/--output paths, enabling ../, ..\, or absolute path traversal. Exploitation is trivial (single command, no auth) and can overwrite .github/workflows/*.yml, .git/hooks/*, ...

EUVD-2026-57219

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-73374

CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...

CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

PYSEC-2026-2487 Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Summary ChatWorkflow.chatmessage passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturall...

PYSEC-2026-2013 vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server

Summary A resource-exhaustion denial-of-service vulnerability exists in multiple endpoints of the OpenAI-Compatible Server due to the ability to specify Jinja templates via the chattemplate and chattemplatekwargs parameters. If an attacker can supply these parameters to the API, they can cause a...

PYSEC-2026-364 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution

Summary The environment variables KERNELXXX used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection SSTI. By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service. The code can...

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

SummaryA Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Detailschangedetection.io version: 0.45.20docker imagesREPOSITORY TAG IMAGE ID CREATED SIZEdgtlmoon/changedetection.io latest 53529c2e69f...

PYSEC-2026-387 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization...

Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabling attackers to overwrite existing keys like securityContext and inject multi-document YAML to create additional unintended Kubernetes resources. Details The server interpolates...

PT-2026-44826

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.24.1 Description A Server-Side Template Injection SSTI exists in the prompt generator located in rag/prompts/generator.py. This issue allows authenticated users to execute arbitrary operating system commands on the...