EUVD-2026-20588Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.
AnalysisAI
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
InvenTree uses Jinja2 templating for part naming formats. The vulnerability stems from an incomplete remediation of CVE-2026-27629: while the validator was upgraded to jinja2.sandbox.SandboxedEnvironment to prevent template injection, the production renderer in part/helpers.py retained the unrestricted jinja2.Environment. Additionally, the validator creates a dummy Part object with pk=None to test templates, but this allows conditional expressions (such as {% if part.pk %}) to execute different code paths during validation versus real rendering where pk contains an actual value. Attackers with staff permissions and settings modification rights can craft templates that pass the sandboxed validator but execute arbitrary Python code when the unsandboxed renderer processes them. This is a classic Server-Side Template Injection (SSTI) attack enabled by inconsistent sandboxing.
RemediationAI
Upgrade InvenTree to version 1.2.7 or 1.3.0 or later. The patch synchronizes the PART_NAME_FORMAT renderer in part/helpers.py to use the same jinja2.sandbox.SandboxedEnvironment as the validator, and corrects the validation bypass by ensuring template rendering behavior is consistent between validation and production. Organizations unable to upgrade immediately should restrict staff-level access and settings modification permissions to only trusted administrators, and audit recent changes to part naming format templates for suspicious template syntax. For detailed remediation guidance, consult the GitHub Security Advisory at https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior t
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. Rate
Share
External POC / Exploit Code
Leaving vuln.today