CVE-2024-28397-Exploit-Automation

CVE-2024-28397 Automatización de Exploit Un script de automatización en Python para explotar la vulnerabilidad js2py Sandbox Escape CVE-2024-28397. Esta herramienta automatiza el proceso de generación y entrega de payloads para lograr Ejecución Remota de Código RCE en instancias vulnerables. ⚠️...

Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Summary ChatWorkflow.chatmessage passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturall...

GHSA-FRV4-X25R-588M Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Summary ChatWorkflow.chatmessage passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturall...