Ssti
Monthly
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Sandbox method allow-list bypass in Twig versions 1.0.0 through 3.26.x allows untrusted template authors to invoke any public method on Twig\Markup subclass objects, completely circumventing the application-configured SecurityPolicy allowedMethods list. The root cause is that SecurityPolicy::checkMethodAllowed() unconditionally skips policy enforcement for any object that is an instance of Twig\Markup - and because the class is not declared final, subclasses inherit the bypass. Applications using Twig's sandbox mode that pass Markup-derived objects into sandboxed templates (a common pattern for marking HTML as safe) inadvertently expose the full public API of those subclasses to potentially untrusted template authors. Vendor-released patch: 3.27.0. No public exploit identified at time of analysis.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Remote code execution via server-side template injection (SSTI) in document-merge-service affects all versions before 9.1.0, exploitable by authenticated users with access to upload XLSX templates. The xltpl library processes XLSX templates through a non-sandboxed Jinja2 environment, allowing an attacker to embed Jinja2 expressions that execute arbitrary code server-side as the document-merge-server user (UID 901). No active exploitation (KEV) has been confirmed, but Jinja2 SSTI techniques are well-documented and HackTricks references are cited in the advisory, indicating the attack pattern is publicly known.
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitrary JavaScript when the generated zod schema module is imported. Because formatDefaultValue in packages/zod/src/index.ts emits a query-parameter default containing a ${...} expression or backtick directly into a module-level template literal without escaping, the payload runs in whatever environment loads the generated code — the developer workstation, CI pipeline, test runner, or the built application. Publicly available exploit code exists (SSVC: PoC) and the flaw is rated automatable with total technical impact; there is no public evidence of active exploitation.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Server-side template injection in ERPNext's Process Statement of Accounts feature (versions prior to 15.118.0 and 16.29.0) lets an authenticated user with a common operational role inject Jinja template expressions into the subject, body, and pdf_name fields, which are rendered with unrestricted globals including frappe.utils, yielding arbitrary server-side code execution. Tagged RCE/SSTI (CWE-1336) and rated CVSS 9.9 with scope change; no public exploit identified at time of analysis, but the trivial exploitation path and low privilege requirement make this a high-priority patch.
Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directives or Twig-style filters into incident templates, which are interpreted and executed as arbitrary PHP by the server when incidents are rendered. Any account with permission to create or edit incident templates can run OS commands as the web server process, yielding full compromise of the hosting environment. A publicly available proof-of-concept has been confirmed by VulnCheck and the upstream GitHub issue; no active exploitation has been recorded in CISA KEV at time of analysis.
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Authenticated remote code execution in Axway SecureTransport (all versions prior to 5.5-20260528, confirmed present in 5.5-20260326) allows an administrator to inject Java expressions into mail templates that are evaluated server-side when emails are rendered and sent, resulting in full host compromise. The flaw is a Server-Side Template Injection (CWE-1336) reported by Toreon and fixed by Axway; no public exploit identified at time of analysis, though a technical write-up and vendor advisory exist. Because exploitation requires admin privileges (CVSS 4.0 PR:H), risk is bounded to trusted or compromised administrative accounts despite the 9.4 severity.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data exfiltration in Gitleaks before 8.30.1 lets an attacker who controls the report template read arbitrary host environment variables through non-hermetic Sprig functions (env, expandenv, getHostByName) and smuggle them out via attacker-triggered DNS lookups. Because Gitleaks runs in CI/CD with broad access to credentials, tokens, and API keys - including the very secrets it just discovered during a scan - a malicious template turns the scanner into an exfiltration channel. A detailed public write-up describing the technique and the fix exists; there is no CISA KEV listing, so this reflects a demonstrated technique rather than confirmed active exploitation.
Stored Server-Side Template Injection in YesWiki's Bazar module allows an authenticated administrator to plant arbitrary Twig expressions into form semantic template fields (`bn_sem_template`, `bn_sem_reverse_template`), which are persistently stored and later executed server-side when unauthenticated requests reach the public JSON-LD semantic endpoint. Published proof-of-concept in the GHSA advisory confirms full escalation from harmless template evaluation (`{{ 7 * 7 }}` → `49`) to interactive OS-level reverse shell. The fix is confirmed in YesWiki v4.6.6, a dedicated security release addressing 12 CVEs; no CISA KEV listing at time of analysis, but publicly available exploit code exists.
Server-side template injection in Formie, a forms plugin for Craft CMS 5 (verbb/formie 3.0.0-beta.1 through 3.1.26), allows unauthenticated attackers to inject Twig syntax through request-controlled inputs that Hidden fields use as dynamic default values. When a public form contains a Hidden field seeded from the User Agent, Referer, Current URL, a query parameter, or a cookie, the attacker-supplied value reaches Craft's Twig rendering layer and is evaluated server-side, potentially yielding information disclosure, application-state modification, or remote code execution. No public exploit identified at time of analysis, though the flaw is tagged RCE/SSTI and rated CVSS 9.8.
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arbitrary code and disclose sensitive information by injecting Twig expressions into template-rendering features. The unsandboxed Twig environment exposes the application's dependency injection container, turning any admin-accessible template surface into a full RCE primitive. No public exploit identified at time of analysis, but a related auth-bypass chain (GHSA-78x5-c8gw-8279) is documented by VulnCheck and could lower the practical privilege bar.
Server-side template injection in JTL Shop 5.2.0 through 5.7.1 allows remote unauthenticated attackers to inject Smarty template syntax via unsanitized user input, exposing sensitive server-side values like database credentials and encryption keys. On versions 5.4.0 through 5.7.1, the flaw escalates to remote code execution by abusing registered Smarty modifiers (unserialize, file_get_contents) to drop a webshell and execute commands as the web server user. Publicly available exploit code exists via the Sansec research writeup, though no public exploit identified at time of analysis in CISA KEV.
Twig sandbox bypass in Pimcore CMS/DXP 12.3.8 lets authenticated administrators escape the template sandbox by abusing empty checkMethodAllowed() and checkPropertyAllowed() implementations, enabling arbitrary method calls on internal PHP objects such as the DAO layer, Doctrine DBAL Connection, and PDO. Exploitation goes through a malicious Twig template injected via the DataObject ClassDefinition Layout\Text component and can lead to arbitrary file reads, arbitrary SQL execution, and potential remote code execution via PHP object gadget chains; the pimcore_* function wildcard broadens the bypass to every Pimcore Twig function. No public exploit identified at time of analysis, but VulnCheck has published an advisory describing the technique.
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.
Remote code execution in Jupyter Enterprise Gateway (fixed in v3.3.0) is possible because attacker-supplied KERNEL_XXX environment variables (e.g. KERNEL_POD_NAME, KERNEL_WORKING_DIR) sent to the /api/kernels endpoint are rendered through Jinja2 when building the Kubernetes pod manifest, enabling Server-Side Template Injection. Any client able to reach the gateway API can inject Jinja2 expressions to execute Python and OS commands inside the Enterprise Gateway pod, then steal its Kubernetes service account token to read secrets and schedule privileged/hostPath pods, escalating to full cluster compromise. Publicly available exploit code exists (working curl PoCs in the advisory); the flaw is not listed in CISA KEV and EPSS is low at 0.86%.
Remote code execution in Wirtualna Uczelnia (versions up to wu#2016.437.295#0#20260327_105545) allows unauthenticated network attackers to execute arbitrary commands via Server-Side Template Injection in the redirectToUrl endpoint's redirectUrlParameter. The CVSS 4.0 base score of 9.3 reflects no authentication, no user interaction, and high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Disclosure originated from CERT-PL, indicating a vetted advisory channel for this Polish academic management product.
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.
Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.
Server-Side Template Injection in Mautic's theme engine allows authenticated users with theme creation or upload permissions to execute arbitrary code on the host. Because the platform renders uploaded Twig templates without a sandbox or strict function allowlist, an attacker who already holds theme-management rights can pivot from administrative content control to full server compromise, including reads of restricted system files and configuration. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.
Template injection in Rancher Local Path Provisioner allows Kubernetes cluster operators with ConfigMap edit permissions to escalate privileges to node-level root access. Attackers with write access to the local-path-config ConfigMap can inject malicious Pod templates that bypass security controls, creating privileged containers with full host filesystem access. This enables theft of ServiceAccount tokens from co-located pods, access to other tenants' persistent volume data, and arbitrary modification of host node files. Vendor-released patch: v0.0.36. CVSS 8.7 (High) reflects the high-privilege prerequisite (PR:H) but scope change to container escape (S:C). No public exploit identified at time of analysis, though exploitation is straightforward for authenticated cluster operators.
Server-Side Template Injection leading to Remote Code Execution affects the banks LLM prompt-templating library (versions <= 2.4.1), which renders Jinja2 templates through an unsandboxed jinja2.Environment(). Any application that passes attacker-controlled strings as the template argument to Prompt() lets an attacker traverse Python dunder attributes to import os and run arbitrary host commands. A working proof-of-concept exists (publicly available exploit code exists) demonstrating command execution and file writes; there is no evidence of active exploitation (EPSS 0.15%, not in CISA KEV).
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Server-side template injection in LiteLLM Proxy versions 1.80.5 through 1.83.6 allows authenticated users to execute arbitrary code via the POST /prompts/test endpoint. Any user with a valid proxy API key can submit malicious prompt templates that escape sandboxing and run commands in the proxy server process, exposing environment secrets like provider API keys and database credentials. This vulnerability affects deployments using LiteLLM as an AI gateway proxy server. No active exploitation confirmed (not in CISA KEV), but GitHub advisory and patch are publicly available, increasing exploit likelihood. CVSS 8.6 (High) with network attack vector and low complexity, though PR:L requirement limits exposure to authenticated attackers only.
Server-Side Template Injection in Kirby CMS (versions before 4.9.0 and 5.0.0-5.3.x) lets an authenticated Panel user achieve remote code execution and unauthorized read/write actions by planting malicious query templates in untrusted dynamic option sources. Affected sites are those using option fields (checkboxes, color, multiselect, select, radio, tags, toggles) or the Options package with values sourced from a query or API, where the double-resolution of dynamic values re-parses attacker-controlled strings such as {{ users.first.password }} or {{ page.delete }}. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but vendor-rated severity is high; SSVC technical impact is total.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization' capability to execute arbitrary JavaScript in the platform process context. Affecting all versions prior to 6.9.5, this vulnerability permits authenticated high-privilege users to achieve complete system compromise through unsafe EJS template rendering in safeEjs.ts. No public exploit code identified and EPSS score of 0.07% indicates low observed exploitation probability, but CVSS 9.1 Critical rating reflects the total technical impact once privileged access is obtained. Vendor patch released in version 6.9.5.
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
Remote code execution in BentoML's containerization workflow allows attackers to execute arbitrary Python code on victim machines by distributing malicious bento archives containing SSTI payloads. When victims import a weaponized bento and run 'bentoml containerize', unsanitized Jinja2 template rendering executes attacker-controlled code directly on the host system - bypassing all Docker container isolation. The vulnerability stems from using an unsandboxed jinja2.Environment with the dangerous jinja2.ext.do extension to process user-provided dockerfile_template files. Authentication is not required (CVSS PR:N), though exploitation requires user interaction (UI:R) to import and containerize the malicious bento. No public exploit identified at time of analysis, though the GitHub advisory includes detailed proof-of-concept demonstrating host filesystem compromise.
Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.
Remote code execution in giskard-agents Python library (versions ≤0.3.3 and 1.0.x alpha) allows attackers to execute arbitrary system commands when user-controlled strings are passed to the ChatWorkflow.chat() method. The vulnerability stems from unsandboxed Jinja2 template rendering that enables class traversal exploitation via Python's object introspection. Patched in versions 0.3.4 (stable) and 1.0.2b1 (pre-release). Public exploit code exists demonstrating full RCE via Jinja2 object traversal to os.popen(). No active exploitation confirmed at time of analysis, though the straightforward attack vector and clear POC make this a critical priority for affected deployments.
Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.
A security vulnerability in renders user-supplied template content (CVSS 8.5) that allows an authenticated user with access. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Remote code execution in OpenMetadata versions 1.5.0 through 1.11.3 is achievable by an authenticated administrator via Server-Side Template Injection in the FreeMarker email templating engine. The platform stores administrator-supplied email template content in its database and renders it without sandboxing controls, allowing FreeMarker directives to instantiate arbitrary Java classes and execute OS commands server-side. A detailed public proof-of-concept from FPT Cloud AppSec Research Team is available; no active exploitation is confirmed in CISA KEV at time of analysis.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template engine's themeeditor.php. By crafting template conditional strings using PHP's alternative function call syntax, attackers bypass security filters and execute arbitrary PHP code on the server.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Server-side template injection (SSTI) in Nozomi Networks Guardian and CMC Dashboard functionality (versions prior to 26.3.0) allows an authenticated low-privilege user to embed malicious template payloads in dashboard definitions. When a victim - potentially one with elevated privileges - views or imports the crafted dashboard, the payload executes in their browser context, enabling modification of application data or disruption of the monitoring platform. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available.
Server-side template injection (SSTI) via the FreeMarker engine in Dromara UJCMS 10.1.0 through 10.1.3 allows authenticated backend administrators to inject malicious template directives through the web-file-template update API endpoint. Exploitation requires high-privilege backend credentials but is network-reachable with no user interaction, and a public proof-of-concept exploit has been published on GitHub demonstrating the attack path. The vendor-scored CVSS 4.0 impact is rated low across confidentiality, integrity, and availability, though the FreeMarker SSTI class is capable of full JVM-level code execution if template sandboxing is absent or misconfigured - defenders should not assume the impact ceiling matches the reported score.
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.
Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.
Server-side template injection (SSTI) in Dify's Jinja2 Handler (versions ≤1.14.2) allows remote, low-privileged authenticated attackers to inject malicious Jinja2 template expressions through the code execution subsystem, resulting in information disclosure and potential further impact. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. The vendor did not respond to responsible disclosure, meaning no patch has been released and no official mitigation guidance exists.
Denial of service in Gogs (self-hosted Git service) allows low-privileged authenticated users to crash the issue rendering pipeline on any repository page containing an issue reference. By setting a malformed external issue tracker URL format with an unclosed '{', the template expansion function panics, making the affected repository's pages unavailable to all viewers. A proof-of-concept is available but no active exploitation has been reported (EPSS 0.28%).
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis.
Angular template injection in the Reports functionality of Nozomi Networks Guardian and CMC (versions prior to 26.1.0) allows an authenticated user with report privileges to execute arbitrary Angular template expressions in a victim's browser context. Exploitation requires either the attacker to possess report creation privileges directly, or to socially engineer a victim into importing a crafted malicious report template. Successful exploitation enables modification of application data or disruption of application availability; however, full XSS exploitation and direct information disclosure are explicitly constrained by the product's existing input validation and Content Security Policy configuration. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Customer security group to inject malicious FreeMarker (FTL) template expressions via Data Resource records, yielding partial information disclosure and content integrity impact. The root cause is that the platform's Ecommerce Customer role carried content management grants by default, exposing the FTL template rendering engine to insufficiently trusted input. No public exploit has been identified at time of analysis and EPSS probability is very low (0.02%, 7th percentile), though SSVC flags the attack path as automatable once an account is obtained.
Server-Side Template Injection in PublicCMS 5.202506.d allows authenticated remote attackers to execute arbitrary code and access sensitive information via the templateResult API endpoint. The vulnerability exists in the TemplateResultDirective.java component, where the templateContent parameter lacks proper sanitization, enabling template engine injection attacks. Publicly available exploit code exists (VulnPlus disclosure), and the vendor has not responded to coordinated disclosure attempts, leaving users without an official patch.
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose sensitive information by rendering unsandboxed Jinja2 templates in the instance_info['ks_template'] parameter. The vulnerability requires high-privilege user interaction and has low confidentiality impact with no integrity or availability consequences.
Server-side template injection in AstrBot Dashboard API (version 4.22.1 and earlier) allows remote authenticated attackers with high privileges to execute arbitrary template code via the create_template function, leading to information disclosure and potential code execution. Publicly available exploit code exists, and the vendor has not yet responded to disclosure despite early notification.
Remote code execution in giskard-checks through server-side template injection (SSTI) in the ConformityCheck class allows arbitrary Python code execution when the rule parameter is processed via unsandboxed Jinja2 template rendering. Affected versions prior to 1.0.2b1 silently interpret rule strings as Jinja2 templates, enabling attackers with write access to check definitions or configuration files to inject malicious template expressions that execute during test suite execution. Exploitation requires local file write access and subsequent developer execution of the test suite, but the implicit template evaluation increases risk when untrusted check definitions are integrated from shared projects or external sources.
Server-side template injection in PyBlade's AST validation function (_is_safe_ast in sandbox.py) allows authenticated remote attackers to bypass template safety checks and inject arbitrary template code, leading to information disclosure and potential code execution. Affected versions 0.1.8-alpha and 0.1.9-alpha contain improper neutralization of special template elements. Publicly available exploit code exists, though the vendor has not yet responded to disclosure.
JumpServer contains a Server-Side Template Injection (SSTI) vulnerability in its Applet and VirtualApp upload functionality that allows authenticated administrators to execute arbitrary code within the JumpServer Core container. The vulnerability affects JumpServer versions vulnerable to unsafe Jinja2 template rendering of user-uploaded YAML manifest files. While requiring high privilege level (Application Applet Management or Virtual Application Management permissions), successful exploitation results in complete container compromise with high confidentiality, integrity, and availability impact.
Server-side template injection via Apache Velocity in WSO2 Identity Server 5.11.0 enables an authenticated administrator to execute arbitrary code on the underlying server. The vulnerability stems from insufficient sandboxing of user-controlled input passed to the Velocity rendering engine in admin-accessible surfaces, allowing template directives to invoke JVM reflection and reach OS-level execution. No public exploit code has been identified at time of analysis; EPSS of 0.44% at the 63rd percentile indicates moderate relative interest but low absolute near-term exploitation probability.
An issue was discovered in Logpoint before 7.7.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LangChain is a framework for building agents and LLM-powered applications. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Advanced Views - Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection.7.0. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.
Craft is a content management system. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity.
Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.
IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Server-side template injection (SSTI) in Tanium Comply enables remote code execution by a highly privileged authenticated user, yielding full confidentiality, integrity, and availability impact on the Comply server. The vulnerability (CWE-1336) results from insufficient neutralization of template directives in user-controlled input, allowing the underlying template engine to evaluate and execute injected payloads server-side. Tanium addressed this in advisory TAN-2026-040; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthenticated attackers to execute arbitrary code by injecting special elements into the template engine (CWE-1336). Rated CVSS 10.0 with a changed scope, the flaw requires no user interaction and grants code execution in the context of the current user, per Adobe advisory APSB26-146. No public exploit has been identified at time of analysis, but the maximal score and unauthenticated network reach make this a top-priority patch for e-commerce operators.
Sandbox method allow-list bypass in Twig versions 1.0.0 through 3.26.x allows untrusted template authors to invoke any public method on Twig\Markup subclass objects, completely circumventing the application-configured SecurityPolicy allowedMethods list. The root cause is that SecurityPolicy::checkMethodAllowed() unconditionally skips policy enforcement for any object that is an instance of Twig\Markup - and because the class is not declared final, subclasses inherit the bypass. Applications using Twig's sandbox mode that pass Markup-derived objects into sandboxed templates (a common pattern for marking HTML as safe) inadvertently expose the full public API of those subclasses to potentially untrusted template authors. Vendor-released patch: 3.27.0. No public exploit identified at time of analysis.
Template injection in the AWS CDK generator component of Amazon's awslabs.dynamodb-mcp-server allows a context-dependent attacker to achieve arbitrary code execution on the host machine that processes and deploys the generated CDK application. The attack surface is the data model file: crafted DynamoDB table, index, or attribute names containing template engine directives are passed unsanitized through the CDK generator, with payload execution occurring at deploy time. Versions before 2.1.6 are affected; no public exploit or active exploitation is confirmed at the time of analysis.
Server-side template injection (SSTI) in IBM Verify Identity Access and Security Verify Access exposes sensitive information to unauthenticated remote attackers via a network-accessible endpoint. The vulnerability affects both traditional appliance deployments and container variants across IBM's IAM product family (versions 10.x and 11.x), and is particularly notable given that IAM platforms routinely handle authentication tokens, user credentials, and security policy configuration - data whose disclosure has outsized downstream impact. IBM has assessed the impact as confidentiality-only (I:N/A:N in the CVSS vector), suggesting the template injection is sandboxed against code execution, but no public exploit or active exploitation has been identified at time of analysis.
Template injection in Eclipse Ditto's ImplicitThingCreationMessageMapper (versions 1.3.0 through 3.9.6) allows authenticated connection publishers to override the administrator-configured access policy of a newly provisioned digital twin by embedding JSON-breaking characters in attacker-controlled inbound message headers. The mapper substitutes header placeholder values as raw, unescaped strings into a pre-configured JSON thing-template before parsing, enabling a crafted header value containing a double-quote to escape its string context and inject an inline _policy object - effectively granting the attacker full read/write access to the twin while permanently revoking the legitimate owner's access. Exploitation requires a non-default mapper configuration and a template that reflects attacker-controllable headers; no public exploit code or active exploitation (CISA KEV) has been identified.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated remote code execution affects BerriAI litellm through version 1.82.4, where the /prompts/test endpoint renders the attacker-supplied dotprompt_content parameter through an unsandboxed jinja2.Environment. Because no authentication is required and templates are evaluated server-side, an attacker can inject a Jinja2 payload that escapes into Python and runs arbitrary OS commands on the proxy host. No public exploit identified at time of analysis and the EPSS probability is low (0.25%), but the CVSS is 9.8 and a third-party technical write-up is referenced.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Remote code execution via server-side template injection (SSTI) in document-merge-service affects all versions before 9.1.0, exploitable by authenticated users with access to upload XLSX templates. The xltpl library processes XLSX templates through a non-sandboxed Jinja2 environment, allowing an attacker to embed Jinja2 expressions that execute arbitrary code server-side as the document-merge-server user (UID 901). No active exploitation (KEV) has been confirmed, but Jinja2 SSTI techniques are well-documented and HackTricks references are cited in the advisory, indicating the attack pattern is publicly known.
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitrary JavaScript when the generated zod schema module is imported. Because formatDefaultValue in packages/zod/src/index.ts emits a query-parameter default containing a ${...} expression or backtick directly into a module-level template literal without escaping, the payload runs in whatever environment loads the generated code — the developer workstation, CI pipeline, test runner, or the built application. Publicly available exploit code exists (SSVC: PoC) and the flaw is rated automatable with total technical impact; there is no public evidence of active exploitation.
Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).
Server-side template injection in CamaleonCMS 2.9.1 enables authenticated administrators to achieve arbitrary remote code execution by embedding ERB expressions in the email parameter of the admin test_email endpoint. When SMTP rejects the crafted recipient address, Rails renders the rejection exception message as an inline ERB template, evaluating attacker-controlled Ruby code as the Rails process user. A patch is available from the vendor; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 7.5 reflects high confidentiality, integrity, and availability impact constrained by the admin-only prerequisite and the SMTP-rejection triggering condition.
Server-side template injection in ERPNext's Process Statement of Accounts feature (versions prior to 15.118.0 and 16.29.0) lets an authenticated user with a common operational role inject Jinja template expressions into the subject, body, and pdf_name fields, which are rendered with unrestricted globals including frappe.utils, yielding arbitrary server-side code execution. Tagged RCE/SSTI (CWE-1336) and rated CVSS 9.9 with scope change; no public exploit identified at time of analysis, but the trivial exploitation path and low privilege requirement make this a high-priority patch.
Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directives or Twig-style filters into incident templates, which are interpreted and executed as arbitrary PHP by the server when incidents are rendered. Any account with permission to create or edit incident templates can run OS commands as the web server process, yielding full compromise of the hosting environment. A publicly available proof-of-concept has been confirmed by VulnCheck and the upstream GitHub issue; no active exploitation has been recorded in CISA KEV at time of analysis.
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injection payloads that execute arbitrary commands as root, giving full host compromise. Publicly available exploit code exists (Stuub's SSTI-to-Root-RCE PoC), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.28% (20th percentile), indicating no evidence of widespread automated exploitation yet. The combination of a working PoC and root-level impact makes this a high-priority patch target for any internet-exposed WGDashboard instance.
Unsandboxed Twig template rendering in Bolt CMS allows any user holding an editor-level CMS role to inject arbitrary OS commands via Server-Side Template Injection (SSTI), achieving remote code execution as the web server process. The root cause is that Bolt's Twig environment never registers a SandboxExtension, so the full Twig filter chain - including dangerous filters like `passthru` - is available to content authors. The default out-of-the-box configuration of the 'pages' content type ships with `allow_twig: true`, meaning this is exploitable in a standard Bolt installation without any additional misconfiguration. No public exploit has been independently confirmed, though the CVE description includes a working payload demonstrating command execution.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Authenticated remote code execution in Axway SecureTransport (all versions prior to 5.5-20260528, confirmed present in 5.5-20260326) allows an administrator to inject Java expressions into mail templates that are evaluated server-side when emails are rendered and sent, resulting in full host compromise. The flaw is a Server-Side Template Injection (CWE-1336) reported by Toreon and fixed by Axway; no public exploit identified at time of analysis, though a technical write-up and vendor advisory exist. Because exploitation requires admin privileges (CVSS 4.0 PR:H), risk is bounded to trusted or compromised administrative accounts despite the 9.4 severity.
Server-side template injection in Tugtainer (self-hosted Docker container auto-update tool) versions before 1.30.2 lets any authenticated user achieve root-level OS command execution by injecting Jinja2 expressions into notification templates. The title_template and body_template fields are rendered by an unsandboxed jinja2.Environment, so template payloads escape into arbitrary code running as root inside the container. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sensitive data exfiltration in Gitleaks before 8.30.1 lets an attacker who controls the report template read arbitrary host environment variables through non-hermetic Sprig functions (env, expandenv, getHostByName) and smuggle them out via attacker-triggered DNS lookups. Because Gitleaks runs in CI/CD with broad access to credentials, tokens, and API keys - including the very secrets it just discovered during a scan - a malicious template turns the scanner into an exfiltration channel. A detailed public write-up describing the technique and the fix exists; there is no CISA KEV listing, so this reflects a demonstrated technique rather than confirmed active exploitation.
Stored Server-Side Template Injection in YesWiki's Bazar module allows an authenticated administrator to plant arbitrary Twig expressions into form semantic template fields (`bn_sem_template`, `bn_sem_reverse_template`), which are persistently stored and later executed server-side when unauthenticated requests reach the public JSON-LD semantic endpoint. Published proof-of-concept in the GHSA advisory confirms full escalation from harmless template evaluation (`{{ 7 * 7 }}` → `49`) to interactive OS-level reverse shell. The fix is confirmed in YesWiki v4.6.6, a dedicated security release addressing 12 CVEs; no CISA KEV listing at time of analysis, but publicly available exploit code exists.
Server-side template injection in Formie, a forms plugin for Craft CMS 5 (verbb/formie 3.0.0-beta.1 through 3.1.26), allows unauthenticated attackers to inject Twig syntax through request-controlled inputs that Hidden fields use as dynamic default values. When a public form contains a Hidden field seeded from the User Agent, Referer, Current URL, a query parameter, or a cookie, the attacker-supplied value reaches Craft's Twig rendering layer and is evaluated server-side, potentially yielding information disclosure, application-state modification, or remote code execution. No public exploit identified at time of analysis, though the flaw is tagged RCE/SSTI and rated CVSS 9.8.
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arbitrary code and disclose sensitive information by injecting Twig expressions into template-rendering features. The unsandboxed Twig environment exposes the application's dependency injection container, turning any admin-accessible template surface into a full RCE primitive. No public exploit identified at time of analysis, but a related auth-bypass chain (GHSA-78x5-c8gw-8279) is documented by VulnCheck and could lower the practical privilege bar.
Server-side template injection in JTL Shop 5.2.0 through 5.7.1 allows remote unauthenticated attackers to inject Smarty template syntax via unsanitized user input, exposing sensitive server-side values like database credentials and encryption keys. On versions 5.4.0 through 5.7.1, the flaw escalates to remote code execution by abusing registered Smarty modifiers (unserialize, file_get_contents) to drop a webshell and execute commands as the web server user. Publicly available exploit code exists via the Sansec research writeup, though no public exploit identified at time of analysis in CISA KEV.
Twig sandbox bypass in Pimcore CMS/DXP 12.3.8 lets authenticated administrators escape the template sandbox by abusing empty checkMethodAllowed() and checkPropertyAllowed() implementations, enabling arbitrary method calls on internal PHP objects such as the DAO layer, Doctrine DBAL Connection, and PDO. Exploitation goes through a malicious Twig template injected via the DataObject ClassDefinition Layout\Text component and can lead to arbitrary file reads, arbitrary SQL execution, and potential remote code execution via PHP object gadget chains; the pimcore_* function wildcard broadens the bypass to every Pimcore Twig function. No public exploit identified at time of analysis, but VulnCheck has published an advisory describing the technique.
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.
Remote code execution in Jupyter Enterprise Gateway (fixed in v3.3.0) is possible because attacker-supplied KERNEL_XXX environment variables (e.g. KERNEL_POD_NAME, KERNEL_WORKING_DIR) sent to the /api/kernels endpoint are rendered through Jinja2 when building the Kubernetes pod manifest, enabling Server-Side Template Injection. Any client able to reach the gateway API can inject Jinja2 expressions to execute Python and OS commands inside the Enterprise Gateway pod, then steal its Kubernetes service account token to read secrets and schedule privileged/hostPath pods, escalating to full cluster compromise. Publicly available exploit code exists (working curl PoCs in the advisory); the flaw is not listed in CISA KEV and EPSS is low at 0.86%.
Remote code execution in Wirtualna Uczelnia (versions up to wu#2016.437.295#0#20260327_105545) allows unauthenticated network attackers to execute arbitrary commands via Server-Side Template Injection in the redirectToUrl endpoint's redirectUrlParameter. The CVSS 4.0 base score of 9.3 reflects no authentication, no user interaction, and high impact across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Disclosure originated from CERT-PL, indicating a vetted advisory channel for this Polish academic management product.
Server-side template injection in Apache Airflow versions 3.0.0 through 3.2.1 allows low-privilege authenticated users to inject Jinja2 expressions via dag_run.conf parameters that are unsafely interpolated into BashOperator commands, leading to arbitrary command execution in the worker context. The flaw carries a 9.1 CVSS but EPSS sits at just 0.03% (9th percentile), and there is no public exploit identified at time of analysis despite a vendor patch being available. Disclosure occurred via the oss-security mailing list on 2026-05-31 alongside several other Airflow advisories.
Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.
Server-side template injection in RAGFlow 0.24.0 and earlier allows any authenticated user to execute arbitrary operating system commands on the host through the Jinja2-based prompt generator (rag/prompts/generator.py). Because RAGFlow installations commonly permit open self-registration, the practical barrier is minimal: an attacker registers an account, builds a Canvas workflow chaining a DuckDuckGo retrieval node with an LLM node, and triggers the SSTI to break out of the Jinja2 sandbox. No public exploit identified at time of analysis, but the vendor security advisory describes the chain explicitly.
Server-Side Template Injection in Mautic's theme engine allows authenticated users with theme creation or upload permissions to execute arbitrary code on the host. Because the platform renders uploaded Twig templates without a sandbox or strict function allowlist, an attacker who already holds theme-management rights can pivot from administrative content control to full server compromise, including reads of restricted system files and configuration. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.
Template injection in Rancher Local Path Provisioner allows Kubernetes cluster operators with ConfigMap edit permissions to escalate privileges to node-level root access. Attackers with write access to the local-path-config ConfigMap can inject malicious Pod templates that bypass security controls, creating privileged containers with full host filesystem access. This enables theft of ServiceAccount tokens from co-located pods, access to other tenants' persistent volume data, and arbitrary modification of host node files. Vendor-released patch: v0.0.36. CVSS 8.7 (High) reflects the high-privilege prerequisite (PR:H) but scope change to container escape (S:C). No public exploit identified at time of analysis, though exploitation is straightforward for authenticated cluster operators.
Server-Side Template Injection leading to Remote Code Execution affects the banks LLM prompt-templating library (versions <= 2.4.1), which renders Jinja2 templates through an unsandboxed jinja2.Environment(). Any application that passes attacker-controlled strings as the template argument to Prompt() lets an attacker traverse Python dunder attributes to import os and run arbitrary host commands. A working proof-of-concept exists (publicly available exploit code exists) demonstrating command execution and file writes; there is no evidence of active exploitation (EPSS 0.15%, not in CISA KEV).
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Server-side template injection in LiteLLM Proxy versions 1.80.5 through 1.83.6 allows authenticated users to execute arbitrary code via the POST /prompts/test endpoint. Any user with a valid proxy API key can submit malicious prompt templates that escape sandboxing and run commands in the proxy server process, exposing environment secrets like provider API keys and database credentials. This vulnerability affects deployments using LiteLLM as an AI gateway proxy server. No active exploitation confirmed (not in CISA KEV), but GitHub advisory and patch are publicly available, increasing exploit likelihood. CVSS 8.6 (High) with network attack vector and low complexity, though PR:L requirement limits exposure to authenticated attackers only.
Server-Side Template Injection in Kirby CMS (versions before 4.9.0 and 5.0.0-5.3.x) lets an authenticated Panel user achieve remote code execution and unauthorized read/write actions by planting malicious query templates in untrusted dynamic option sources. Affected sites are those using option fields (checkboxes, color, multiselect, select, radio, tags, toggles) or the Options package with values sourced from a query or API, where the double-resolution of dynamic values re-parses attacker-controlled strings such as {{ users.first.password }} or {{ page.delete }}. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but vendor-rated severity is high; SSVC technical impact is total.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Server-Side Template Injection in OpenCTI notifier templates allows privileged administrators with 'Manage customization' capability to execute arbitrary JavaScript in the platform process context. Affecting all versions prior to 6.9.5, this vulnerability permits authenticated high-privilege users to achieve complete system compromise through unsafe EJS template rendering in safeEjs.ts. No public exploit code identified and EPSS score of 0.07% indicates low observed exploitation probability, but CVSS 9.1 Critical rating reflects the total technical impact once privileged access is obtained. Vendor patch released in version 6.9.5.
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
Remote code execution in BentoML's containerization workflow allows attackers to execute arbitrary Python code on victim machines by distributing malicious bento archives containing SSTI payloads. When victims import a weaponized bento and run 'bentoml containerize', unsanitized Jinja2 template rendering executes attacker-controlled code directly on the host system - bypassing all Docker container isolation. The vulnerability stems from using an unsandboxed jinja2.Environment with the dangerous jinja2.ext.do extension to process user-provided dockerfile_template files. Authentication is not required (CVSS PR:N), though exploitation requires user interaction (UI:R) to import and containerize the malicious bento. No public exploit identified at time of analysis, though the GitHub advisory includes detailed proof-of-concept demonstrating host filesystem compromise.
Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.
Remote code execution in giskard-agents Python library (versions ≤0.3.3 and 1.0.x alpha) allows attackers to execute arbitrary system commands when user-controlled strings are passed to the ChatWorkflow.chat() method. The vulnerability stems from unsandboxed Jinja2 template rendering that enables class traversal exploitation via Python's object introspection. Patched in versions 0.3.4 (stable) and 1.0.2b1 (pre-release). Public exploit code exists demonstrating full RCE via Jinja2 object traversal to os.popen(). No active exploitation confirmed at time of analysis, though the straightforward attack vector and clear POC make this a critical priority for affected deployments.
Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance access to read and write arbitrary files as root on the host system through exploitation of pongo2 template processing. The vulnerability (scored CVSS 10.0 critical) stems from a bypassed chroot isolation mechanism that was intended to confine template operations to instance filesystems but instead permits unrestricted host filesystem access. No public exploit identified at time of analysis, though the vulnerability is tagged as Server-Side Template Injection (SSTI) with a GitHub security advisory published.
A security vulnerability in renders user-supplied template content (CVSS 8.5) that allows an authenticated user with access. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Remote code execution in OpenMetadata versions 1.5.0 through 1.11.3 is achievable by an authenticated administrator via Server-Side Template Injection in the FreeMarker email templating engine. The platform stores administrator-supplied email template content in its database and renders it without sandboxing controls, allowing FreeMarker directives to instantiate arbitrary Java classes and execute OS commands server-side. A detailed public proof-of-concept from FPT Cloud AppSec Research Team is available; no active exploitation is confirmed in CISA KEV at time of analysis.
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template engine's themeeditor.php. By crafting template conditional strings using PHP's alternative function call syntax, attackers bypass security filters and execute arbitrary PHP code on the server.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Server-side template injection (SSTI) in Nozomi Networks Guardian and CMC Dashboard functionality (versions prior to 26.3.0) allows an authenticated low-privilege user to embed malicious template payloads in dashboard definitions. When a victim - potentially one with elevated privileges - views or imports the crafted dashboard, the payload executes in their browser context, enabling modification of application data or disruption of the monitoring platform. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available.
Server-side template injection (SSTI) via the FreeMarker engine in Dromara UJCMS 10.1.0 through 10.1.3 allows authenticated backend administrators to inject malicious template directives through the web-file-template update API endpoint. Exploitation requires high-privilege backend credentials but is network-reachable with no user interaction, and a public proof-of-concept exploit has been published on GitHub demonstrating the attack path. The vendor-scored CVSS 4.0 impact is rated low across confidentiality, integrity, and availability, though the FreeMarker SSTI class is capable of full JVM-level code execution if template sandboxing is absent or misconfigured - defenders should not assume the impact ceiling matches the reported score.
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Server-side template injection in JumpServer prior to 4.10.17 enables an authenticated administrator with Applet Host management and deployment permissions to plant Jinja2 expressions in the IP/Host or Core Service Address fields, which Ansible then evaluates as live template expressions during Applet Host deployment, yielding arbitrary OS command execution on the JumpServer control node. The patch was released in v4.10.17, confirmed via the GitHub release tag, and no public exploit code or CISA KEV entry has been identified at time of analysis. Because the control node manages downstream bastion targets, a successful exploit has blast radius well beyond the JumpServer process itself.
Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.
Server-side template injection (SSTI) in Dify's Jinja2 Handler (versions ≤1.14.2) allows remote, low-privileged authenticated attackers to inject malicious Jinja2 template expressions through the code execution subsystem, resulting in information disclosure and potential further impact. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. The vendor did not respond to responsible disclosure, meaning no patch has been released and no official mitigation guidance exists.
Denial of service in Gogs (self-hosted Git service) allows low-privileged authenticated users to crash the issue rendering pipeline on any repository page containing an issue reference. By setting a malformed external issue tracker URL format with an unclosed '{', the template expansion function panics, making the affected repository's pages unavailable to all viewers. A proof-of-concept is available but no active exploitation has been reported (EPSS 0.28%).
Server-side template injection (SSTI) in Dromara lamp-cloud versions 5.6.0 through 5.6.2 exposes the Message Template Handler to remote exploitation by authenticated low-privileged users who can inject malicious Groovy expressions via the DefMsgTemplate.content parameter. The vulnerable function GroovyClassLoader.parseClass compiles and executes attacker-controlled input as Groovy code at runtime. A public proof-of-concept exploit has been disclosed on GitHub, and the vendor has not responded to the coordinated disclosure, leaving no official patch available at time of analysis.
Angular template injection in the Reports functionality of Nozomi Networks Guardian and CMC (versions prior to 26.1.0) allows an authenticated user with report privileges to execute arbitrary Angular template expressions in a victim's browser context. Exploitation requires either the attacker to possess report creation privileges directly, or to socially engineer a victim into importing a crafted malicious report template. Successful exploitation enables modification of application data or disruption of application availability; however, full XSS exploitation and direct information disclosure are explicitly constrained by the product's existing input validation and Content Security Policy configuration. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Customer security group to inject malicious FreeMarker (FTL) template expressions via Data Resource records, yielding partial information disclosure and content integrity impact. The root cause is that the platform's Ecommerce Customer role carried content management grants by default, exposing the FTL template rendering engine to insufficiently trusted input. No public exploit has been identified at time of analysis and EPSS probability is very low (0.02%, 7th percentile), though SSVC flags the attack path as automatable once an account is obtained.
Server-Side Template Injection in PublicCMS 5.202506.d allows authenticated remote attackers to execute arbitrary code and access sensitive information via the templateResult API endpoint. The vulnerability exists in the TemplateResultDirective.java component, where the templateContent parameter lacks proper sanitization, enabling template engine injection attacks. Publicly available exploit code exists (VulnPlus disclosure), and the vendor has not responded to coordinated disclosure attempts, leaving users without an official patch.
Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose sensitive information by rendering unsandboxed Jinja2 templates in the instance_info['ks_template'] parameter. The vulnerability requires high-privilege user interaction and has low confidentiality impact with no integrity or availability consequences.
Server-side template injection in AstrBot Dashboard API (version 4.22.1 and earlier) allows remote authenticated attackers with high privileges to execute arbitrary template code via the create_template function, leading to information disclosure and potential code execution. Publicly available exploit code exists, and the vendor has not yet responded to disclosure despite early notification.
Remote code execution in giskard-checks through server-side template injection (SSTI) in the ConformityCheck class allows arbitrary Python code execution when the rule parameter is processed via unsandboxed Jinja2 template rendering. Affected versions prior to 1.0.2b1 silently interpret rule strings as Jinja2 templates, enabling attackers with write access to check definitions or configuration files to inject malicious template expressions that execute during test suite execution. Exploitation requires local file write access and subsequent developer execution of the test suite, but the implicit template evaluation increases risk when untrusted check definitions are integrated from shared projects or external sources.
Server-side template injection in PyBlade's AST validation function (_is_safe_ast in sandbox.py) allows authenticated remote attackers to bypass template safety checks and inject arbitrary template code, leading to information disclosure and potential code execution. Affected versions 0.1.8-alpha and 0.1.9-alpha contain improper neutralization of special template elements. Publicly available exploit code exists, though the vendor has not yet responded to disclosure.
JumpServer contains a Server-Side Template Injection (SSTI) vulnerability in its Applet and VirtualApp upload functionality that allows authenticated administrators to execute arbitrary code within the JumpServer Core container. The vulnerability affects JumpServer versions vulnerable to unsafe Jinja2 template rendering of user-uploaded YAML manifest files. While requiring high privilege level (Application Applet Management or Virtual Application Management permissions), successful exploitation results in complete container compromise with high confidentiality, integrity, and availability impact.
Server-side template injection via Apache Velocity in WSO2 Identity Server 5.11.0 enables an authenticated administrator to execute arbitrary code on the underlying server. The vulnerability stems from insufficient sandboxing of user-controlled input passed to the Velocity rendering engine in admin-accessible surfaces, allowing template directives to invoke JVM reflection and reach OS-level execution. No public exploit code has been identified at time of analysis; EPSS of 0.44% at the 63rd percentile indicates moderate relative interest but low absolute near-term exploitation probability.
An issue was discovered in Logpoint before 7.7.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LangChain is a framework for building agents and LLM-powered applications. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Advanced Views - Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achieve remote code execution by loading a specially crafted. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection.7.0. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.
Craft is a content management system. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity.
Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.
IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.