EUVD-2026-43262
GHSA-9x9x-v3ff-pj74
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable handler but requires high complexity and user interaction to trigger; all impacts are low with no scope change, mapping directly from the 4.0 vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Inclusion of functionality from an untrusted control sphere in usestrix strix (up to v1.0.2) allows remote attackers to manipulate the system_prompt.jinja template within the PyPI Handler component, achieving limited confidentiality, integrity, and availability impact. The CVSS 4.0 score of 2.3 reflects high attack complexity and required passive user interaction, placing real-world exploitation difficulty considerably higher than the network-facing attack vector alone implies. A public proof-of-concept is available on GitHub; no patch has been issued and the vendor has not responded to disclosure.
Technical ContextAI
strix (CPE: cpe:2.3:a:usestrix:strix:*:*:*:*:*:*:*:*) is a Python package distributed via PyPI. The vulnerable component is system_prompt.jinja, a Jinja2 template file used by the PyPI Handler. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) describes a class of flaws where an application imports, includes, or executes resources from an external or attacker-influenced location without adequate validation. In a Jinja2 context this commonly manifests as unsafe template inheritance, include directives, or macro imports that reference attacker-controlled paths or URLs - allowing arbitrary template logic or external content to be pulled into the render context. The name 'system_prompt.jinja' strongly suggests strix is used to construct prompts for a large language model, meaning untrusted content injection could also affect downstream AI behaviour beyond classical data integrity impact.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. Users should monitor the usestrix/strix PyPI package for any release beyond 1.0.2 that addresses this issue. As a compensating control, restrict the Jinja2 rendering environment by disabling the FileSystemLoader or any loader that resolves paths outside a trusted template directory, and audit all include and extends directives in system_prompt.jinja to ensure they reference only static, vendor-controlled templates. Sandboxing the Jinja2 environment (jinja2.sandbox.SandboxedEnvironment) reduces but does not eliminate CWE-829 risk; note this may break features that rely on unrestricted template access. The public PoC is available at https://github.com/ez-lbz/strix-vul-report and should be reviewed to understand the specific injection path before applying targeted mitigations. If strix is used in an LLM pipeline, treat any injected system prompt content as untrusted input until the root cause is patched.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today