18 matches found
SGLang-0.5.9-RCE
SGLang SSTI to RCE PoC — 샌드박스가 적용되지 않은 Jinja2 채팅 템플릿 렌더링 CVE-2026-5760 SGLang의 reranking 엔드포인트에서 서버 측 템플릿 주입SSTI을 통한 원격 코드 실행. 악성 GGUF 모델 파일에 조작된 tokenizer.chattemplate이 포함되어 있으며, 해당 모델이 SGLang에 로드되고 /v1/rerank 엔드포인트가 호출되면 임의 코드 실행이 이루어집니다. 기능 SGLang의 샌드박스가 적용되지 않은 Jinja2 템플릿 렌더링을 악용하는 Critical 심...
CVE-2026-82447 Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...
CVE-2026-75574 Grav before 4.2.2 Remote Code Execution via Email Twig
The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...
CVE-2026-75574
CVE-2026-75574 is a remote code execution vulnerability in the Grav Email plugin (getgrav/grav-plugin-email) versions before 4.2.2 . The root cause is that page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates . An authenticated remote user possessing only api....
CVE-2026-75574 Grav before 4.2.2 Remote Code Execution via Email Twig
The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...
PT-2026-81146
The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...
CVE-2026-71291 Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
Summary The ConformityCheck class in giskard-checks rendered the rule parameter through Jinja2's default Template constructor. Because the rule string is silently interpreted as a Jinja2 template, a developer may not realize that template expressions embedded in rule definitions are evaluated at...
EUVD-2026-41213
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect...
CVE-2026-44209
Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment unsandboxed to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt are vulnerable to Server-Side Template Injection...
CVE-2026-44209 Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI
Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment unsandboxed to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt are vulnerable to Server-Side Template Injection...
OpenStack Ironic 安全漏洞
OpenStack Ironic is an integrated OpenStack application developed under the OpenStack open source framework. It is used to configure bare machines rather than virtual machines. OpenStack Ironic versions 35.x and earlier contain security vulnerabilities, which stem from the instanceinfokstemplate...
CVE-2026-5760
SGLang's reranking endpoint /v1/rerank achieves Remote Code Execution RCE when a model file containing a malcious tokenizer.chattemplate is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment...
CVE-2026-40320
Giskard (giskard-checks) CVE-2026-40320 involves unsandboxed Jinja2 template rendering in the ConformityCheck rule processing. In versions prior to 1.0.2b1, ConformityCheck rendered the rule parameter using Jinja2’s default Template(), enabling runtime interpretation of template expressions. If c...
PT-2026-33382
Name of the Vulnerable Software and Affected Versions home-assistant-cli versions prior to 1.0.0 Description The Home Assistant Command-line interface hass-cli used an unrestricted environment instead of a sandboxed one to handle Jinja2 templates. User-supplied input within these templates was...
CVE-2026-35477
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PARTNAMEFORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed...
CVE-2026-28797 RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component
RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions 0.24.0 and prior, a Server-Side Template Injection SSTI vulnerability exists in RAGFlow's Agent workflow Text Processing StringTransform and Message components. These components use Python's jinja2.Template unsandbox...
