Skip to content
Threat Feed
Subscribe

Tag

Jinja2

2 briefs RSS
critical advisory

Giskard-agents ChatWorkflow.chat() Server-Side Template Injection

Giskard-agents versions 0.3.3 and earlier, and versions 1.0.1a1 through 1.0.2a1 are vulnerable to remote code execution via server-side template injection where the ChatWorkflow.chat() method passes user-supplied strings directly to a non-sandboxed Jinja2 Environment, allowing attackers to execute arbitrary code on the server.

ssti jinja2 rce giskard-agents vulnerability
2r 1t
high advisory

banks Library Vulnerable to Server-Side Template Injection Leading to Remote Code Execution

banks version 2.4.1 and earlier is vulnerable to Server-Side Template Injection (SSTI) due to the use of an unsandboxed Jinja2 environment, allowing attackers to achieve Remote Code Execution (RCE) by injecting malicious code through user-supplied prompt templates.

banks ssti rce jinja2
2r 2t 2c