tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...

CVE-2026-104073

NetBox versions 2.9.5 before 4.7.0 are vulnerable to a server-side template injection vulnerability. A low-privileged user with the "Can add custom links" permission can exploit this by exposing the raw Django HttpRequest object to the Jinja2 template context. An attacker can craft a custom link ...

SGLang-0.5.9-RCE

SGLang SSTI to RCE PoC — Unsandboxed Jinja2 Chat Template Rendering CVE-2026-5760 Remote Code Execution via Server-Side Template Injection SSTI in SGLang's reranking endpoint. A malicious GGUF model file with a crafted tokenizer.chattemplate achieves arbitrary code execution when loaded into SGLa...

Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE

Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps. id: CVE-2025-23211 info: name: Tandoor Recipes 1.5.24 - Jinja2 SSTI RCE author: sammiee5311 severity: critical description: | Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows...

EUVD-2026-91720

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

DEBIAN-CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851

The fsspec Python implementation framework (versions 0.9.0 through 2026.6.0 ) is vulnerable to Remote Code Execution (RCE) due to unrestricted jinja2 template evaluation. The flaw exists in fsspec.implementations.reference.ReferenceFileSystem when processing Kerchunk reference JSON documents via ...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-104851 fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template....render... calls in...

CVE-2026-11104-Python-SSTI-via-Jinja2-attr-Filter-Bypass

CVE-2026-11104 – Python SSTI via Jinja2 |attr Filter Bypass Program Code Flask vulnerableapp.py - Flask with Jinja2 SSTI via 'attr' filter from flask import Flask, request, rendertemplatestring app = Flaskname @app.route'/' def index: name = request.args.get'name', 'World' UNSAFE: directly render...

PT-2026-104404

Name of the Vulnerable Software and Affected Versions fsspec versions 0.9.0 through 2026.6.0 Description The fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents using unrestricted jinja2.Template....render... calls within the process...

dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection

A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...

dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection

A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...

dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection

A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Reporter: Cavan Loughran, Celvex Group Inc.Summary-------The fix for CVE-2026-46439 3.12.2 / 4.0.3 removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py MDSectionInclude, MDCleanInclude still re-pars...

SSTI-Exploit-Detector

SSTI-Exploit-Detector SSTI Exploit Detector is a tool designed to detect potential Server-Side Template Injection SSTI vulnerabilities in web applications. SSTI-Exploit-Detector Jenderal92 Features Custom Payload File : Allows users to add their own payloads to test various template engines...