Open GenAI Stack EUVD-2026-89070

Exploitation requires that the target application be built on Open GenAI Stack (ogx-ai) and pass user-supplied prompt content into a Jinja2 template that is evaluated server-side without sanitization - i.e. the SSTI sink must be present in the request/prompt-handling path. Per the CVSS vector there is no authentication, user-interaction, or non-default-configuration requirement (AV:N/AC:L/PR:N/UI:N), so any attacker who can submit a prompt to an affected endpoint can trigger it. The primary real-world limiter is deployment scope: only systems actually running the vulnerable ogx-ai template-rendering path are exposed, and the claimed Meta/WhatsApp exposure is unconfirmed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes an unauthenticated, network-reachable, low-complexity flaw yielding full code execution, which is internally consistent with CWE-94 and the RCE/Code Injection tags: a prompt-injection payload carrying Jinja2 template syntax reaches an unsanitized server-side template evaluation (classic SSTI), so the attacker's 'prompt' becomes executable server code. No EPSS score and no CISA KEV entry are present in the input, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation. A researcher gist (abhi04anon) is referenced by NVD and most likely contains a writeup or working payload, so publicly available exploit code exists should be treated as likely rather than certain until the gist is verified. The key tension is the affected product: 'Open GenAI Stack (ogx-ai)' is an obscure open-source component, but the description claims it is 'used in the Meta AI backend for WhatsApp and other products' - an unverified, high-blast-radius assertion sourced only from the MITRE description, not from a vendor advisory or Meta confirmation. If true, this is a genuine critical-priority issue against a very large surface; if the Meta/WhatsApp linkage is speculative (as such 'as used in' claims often are), real-world exposure is limited to the niche ogx-ai deployments. Verify the WhatsApp/Meta claim and the gist contents with the vendor before treating this as a mass-exploitation priority.

An attacker submits a chat/prompt input containing Jinja2 template syntax (e.g. {{7*7}} escalating to object-traversal payloads reaching os.system) to a GenAI endpoint built on ogx-ai; because the input is rendered server-side without sanitization, the template engine evaluates the expression and executes attacker-controlled code on the backend. No authentication or user interaction is required per the CVSS vector, and a referenced researcher gist likely provides a ready payload, lowering the skill barrier.