What is the CVSS score of CVE-2026-31864?

CVE-2026-31864 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ssti are affected by CVE-2026-31864?

Organizations using JumpServer should be aware of notable risk from CVE-2026-31864 rated CVSS 6.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-31864?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ssti CVE-2026-31864

EUVD-2026-12085 MEDIUM

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-03-13 GitHub_M

Ssti RCE Jumpserver

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.10.16,3.10.22

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-12085

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:22 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks.

AnalysisAI

JumpServer contains a Server-Side Template Injection (SSTI) vulnerability in its Applet and VirtualApp upload functionality that allows authenticated administrators to execute arbitrary code within the JumpServer Core container. The vulnerability affects JumpServer versions vulnerable to unsafe Jinja2 template rendering of user-uploaded YAML manifest files. While requiring high privilege level (Application Applet Management or Virtual Application Management permissions), successful exploitation results in complete container compromise with high confidentiality, integrity, and availability impact.

Technical ContextAI

The vulnerability stems from CWE-1336 (Unsafe Processing of Untrusted Data in Template) and specifically involves unsafe Jinja2 template rendering without sandbox restrictions. JumpServer processes user-uploaded ZIP packages containing manifest.yml configuration files, directly rendering these YAML files through Jinja2's template engine. Jinja2, when used without sandboxing, allows attackers to inject arbitrary template expressions that can access Python builtins and execute arbitrary code. The affected product is the JumpServer bastion host application (cpe:2.3:a:jumpserver:jumpserver:*:*:*:*:*:*:*:*) which serves as an open-source operation and maintenance security audit system. The attack vector is network-based with low attack complexity, but requires high privilege escalation prerequisites (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

RemediationAI

Apply the patch available in PR #16608 (https://github.com/jumpserver/jumpserver/pull/16608) to implement safe Jinja2 template rendering with sandbox restrictions. 2. Upgrade JumpServer to a patched version once released (specific version number not available in provided intelligence; consult GHSA-qx8h-rx2j-j5wc for release dates). 3. Interim mitigation: Restrict Applet and VirtualApp Management permissions to only essential administrative users and implement additional access controls and monitoring around manifest.yml upload activities. 4. Implement input validation and sanitization for uploaded YAML files to prevent injection payloads. 5. Use Jinja2's sandbox environment (jinja2.sandbox.SandboxedEnvironment) instead of the default unsafe Environment for all template rendering operations. 6. Monitor JumpServer container logs for suspicious template rendering activity and unexpected code execution.