Template-Injection — CraftedSignal Threat Feed

NetBox RCE via Jinja2 Template Injection (CVE-2026-29514)

hello@craftedsignal.io — Mon, 04 May 2026 17:16:22 +0000

NetBox, a widely-used infrastructure resource modeling application, is vulnerable to remote code execution (RCE) in versions 4.3.5 through 4.5.4. This vulnerability, identified as CVE-2026-29514, resides in the RenderTemplateMixin.get_environment_params() method. An authenticated attacker with exporttemplate or configtemplate permissions can exploit this flaw by injecting malicious Python callables into the environment_params field. Successful exploitation allows the attacker to bypass the Jinja2 SandboxedEnvironment, achieving arbitrary code execution as the NetBox service user. This RCE can lead to complete system compromise, data exfiltration, or denial of service. Defenders should prioritize patching and implement the detection measures outlined below.

Attack Chain

An authenticated user logs into the NetBox web application with exporttemplate or configtemplate permissions.
The attacker crafts a malicious request to modify or create an export/config template.
Within the request, the attacker injects a Python callable, such as subprocess.getoutput, into the environment_params field. The finalize parameter of the Jinja2 environment is set to this callable.
NetBox processes the request, and the Jinja2 environment is initialized with the attacker-controlled finalize parameter.
When the template is rendered, every expression outside the sandbox’s call interception mechanism is processed.
The injected callable (subprocess.getoutput) is invoked on the rendered expression.
The subprocess.getoutput callable executes arbitrary shell commands as the NetBox service user.
The attacker gains remote code execution, potentially leading to full system compromise or data exfiltration.

Impact

Successful exploitation of CVE-2026-29514 allows an authenticated attacker to execute arbitrary code on the NetBox server. The impact includes potential full system compromise, data exfiltration, and denial of service. Given that NetBox is often used to manage critical infrastructure information, a successful attack could have significant consequences, potentially affecting numerous organizations that rely on accurate network data.

Recommendation

Upgrade NetBox to a patched version (4.5.5 or later) to remediate CVE-2026-29514.
Implement the provided Sigma rule to detect attempts to inject malicious callables into environment_params via webserver logs.
Review and restrict exporttemplate and configtemplate permissions to only those users who require them.

Kirby CMS Server-Side Template Injection via Double Template Resolution

hello@craftedsignal.io — Thu, 23 Apr 2026 21:24:37 +0000

A server-side template injection (SSTI) vulnerability has been identified in Kirby CMS affecting sites using option fields (checkboxes, color, multiselect, select, radio, tags, or toggles) with options sourced from queries or APIs where the values cannot be fully trusted. This vulnerability, discovered and reported by @offset, stems from a double resolution of templates within the options rendering logic. An attacker with Panel access or through user interaction can inject malicious query templates. This can lead to unauthorized access to sensitive information (like user passwords) or malicious modification of site content. The vulnerability affects Kirby CMS versions prior to 4.9.0 and versions between 5.0.0 and 5.4.0.

Attack Chain

An attacker gains access to the Kirby Panel, or convinces a user with access to interact with a malicious element.
The attacker identifies a page or blueprint using dynamic options for form fields (checkboxes, selects, etc.) sourced from a query or API.
The attacker injects a malicious query template, such as {{ users.first.password }} or {{ page.delete }}, into a page title or data returned from an external API.
The administrator or another privileged user navigates to the affected Panel view, triggering the rendering of the form field with the injected malicious template.
The Kirby CMS options logic improperly double-resolves the template, executing the injected query.
The attacker gains access to sensitive information, such as user passwords, or triggers unauthorized actions like page deletion, depending on the injected query.
The attacker escalates privileges by exploiting the compromised user’s session or by directly accessing sensitive information.

Impact

Successful exploitation of this vulnerability could allow attackers to access sensitive site information, such as user credentials, or perform unauthorized actions, like modifying or deleting content. This could lead to a complete compromise of the Kirby CMS website and its data. The vulnerability specifically targets sites that leverage dynamic options for form fields, making them susceptible to malicious query injection. Sites running vulnerable versions of Kirby CMS are at risk of information disclosure and unauthorized modification.

Recommendation

Upgrade to Kirby CMS version 4.9.0 or 5.4.0 or later to patch the vulnerability as described in the advisory (https://github.com/advisories/GHSA-jcjw-58rv-c452).
Apply input validation and sanitization to all data sources used for dynamic options to prevent the injection of malicious templates and mitigate CVE-2026-34587.
Monitor web server logs for suspicious activity, such as requests containing template syntax or attempts to access sensitive information, to identify potential exploitation attempts.

PraisonAI Template Injection Vulnerability (CVE-2026-40154)

hello@craftedsignal.io — Thu, 09 Apr 2026 22:16:36 +0000

PraisonAI, a multi-agent teams system, is susceptible to a critical vulnerability (CVE-2026-40154) affecting versions prior to 4.5.128. The application’s design flaw involves treating remotely fetched template files as trusted executable code. This occurs without performing necessary security checks such as integrity verification, origin validation, or user confirmation. This lack of validation opens a significant attack vector, allowing for supply chain compromises. Attackers can inject malicious code into template files, leading to arbitrary code execution within the PraisonAI environment. The vulnerability was reported on April 9, 2026, and patched in version 4.5.128. Defenders should prioritize upgrading to the latest version to mitigate the risk of exploitation via crafted template files.

Attack Chain

Attacker identifies a PraisonAI instance running a version prior to 4.5.128.
Attacker crafts a malicious template file containing arbitrary code. This could involve injecting shell commands or scripts designed to compromise the system.
The attacker hosts the malicious template file on a remote server under their control.
The attacker manipulates PraisonAI to fetch the malicious template file. This could involve exploiting a configuration setting or tricking a user into initiating the download.
PraisonAI fetches the template file from the attacker’s server without proper validation.
The application treats the template file as trusted executable code.
The malicious code within the template is executed by PraisonAI, leading to arbitrary code execution.
The attacker gains unauthorized access to the PraisonAI system and can perform actions such as data exfiltration, lateral movement, or denial of service.

Impact

Successful exploitation of CVE-2026-40154 can result in a complete compromise of the PraisonAI system. This can lead to unauthorized access to sensitive data, disruption of services, and potential lateral movement within the network. The vulnerable software enables supply chain attacks, making it a critical issue for organizations relying on PraisonAI for their operations. The impact is amplified by the lack of user interaction required for the attack to succeed, with a CVSS v3.1 score of 9.3 highlighting the severity.

Recommendation

Immediately upgrade PraisonAI installations to version 4.5.128 or later to patch CVE-2026-40154.
Implement network monitoring to detect attempts to fetch template files from untrusted sources, using the network_connection log source and the IOCs if available.
Deploy the Sigma rule “Detect PraisonAI Template File Download” to identify suspicious network connections related to template file retrieval.
Implement integrity monitoring on template files if available to detect unauthorized modifications.

GLPI Template Injection RCE (CVE-2026-26026)

hello@craftedsignal.io — Mon, 06 Apr 2026 15:17:07 +0000

GLPI is a widely used open-source IT asset management software. A critical vulnerability, CVE-2026-26026, affects versions 11.0.0 to 11.0.5. This vulnerability stems from a template injection flaw that can be exploited by a logged-in administrator. Successful exploitation allows the administrator to achieve remote code execution (RCE) on the underlying server. The vulnerability was reported on April 6, 2026, and has been patched in version 11.0.6. Organizations using vulnerable versions of GLPI should upgrade immediately to prevent potential compromise. The high CVSS score (9.1) reflects the severity and potential impact of this vulnerability.

Attack Chain

An attacker gains administrative access to a vulnerable GLPI instance (versions 11.0.0 - 11.0.5).
The attacker navigates to a section of the GLPI interface that allows for template modification.
The attacker crafts a malicious template containing code injection payloads.
The attacker saves the modified template within the GLPI system.
The GLPI system processes the malicious template, executing the injected code.
The injected code allows the attacker to execute arbitrary commands on the server.
The attacker establishes a reverse shell to gain persistent access.
The attacker pivots to other systems or exfiltrates sensitive data.

Impact

Successful exploitation of CVE-2026-26026 can lead to complete compromise of the GLPI server. This allows an attacker to gain unauthorized access to sensitive IT asset information, customer data, and potentially other systems on the network. The impact is significant, as it allows for data breaches, service disruption, and further lateral movement within the organization’s infrastructure. Given GLPI’s function in managing IT assets, this can result in widespread damage across the organization.

Recommendation

Immediately upgrade GLPI to version 11.0.6 or later to patch CVE-2026-26026.
Review and audit GLPI administrator accounts for any suspicious activity or unauthorized access attempts.
Deploy the Sigma rule “Detect GLPI Template Injection Attempts” to detect exploitation attempts in web server logs.
Monitor web server logs for unusual POST requests to template management endpoints containing suspicious code constructs.
Investigate any alerts generated by the “Detect GLPI Template Injection RCE” rule in your SIEM.
Restrict network access to the GLPI server to only authorized personnel and systems.

lodash _.template Function Injection Vulnerability (CVE-2026-4800)

hello@craftedsignal.io — Tue, 31 Mar 2026 20:16:29 +0000

CVE-2026-4800 exposes a critical vulnerability within the _.template function of the lodash library in versions prior to 4.18.0. This vulnerability arises from insufficient validation when processing user-supplied input within the options.imports object. Specifically, while a fix for CVE-2021-23337 addressed validation for the variable option, it failed to extend the same rigorous checks to the key names within options.imports. Attackers can exploit this oversight by injecting malicious default-parameter expressions as key names in options.imports, triggering arbitrary code execution during the template compilation phase. This poses a significant risk, especially in applications that accept untrusted input to configure lodash templates, potentially leading to full system compromise. Furthermore, the vulnerability can be exacerbated if the Object.prototype is polluted, allowing inherited properties to be injected into the imports object, increasing the attack surface.

Attack Chain

The application receives untrusted input intended for use in a lodash template.
The attacker crafts a malicious payload containing JavaScript code within the key names of the options.imports object. This payload leverages the default parameter expression vulnerability.
The application passes the attacker-controlled options.imports object to the _.template function.
The _.template function processes the options.imports without proper validation of the key names.
The assignInWith function merges the provided imports, including the attacker-controlled key names and their malicious content, into the template context.
During template compilation, the JavaScript Function() constructor is invoked, embedding the attacker’s injected code.
The injected code executes within the context of the application, granting the attacker arbitrary code execution.
The attacker can leverage this code execution to perform actions such as installing malware, exfiltrating sensitive data, or compromising other parts of the system.

Impact

Successful exploitation of CVE-2026-4800 can lead to arbitrary code execution on the server or client machine where the vulnerable application is running. The severity of this vulnerability is high, as it allows attackers to potentially gain full control of the affected system. The number of potential victims is broad, including any application using a vulnerable version of lodash and processing untrusted input in template configurations. This could affect various sectors, including web applications, APIs, and server-side rendering frameworks. A successful attack could result in data breaches, service disruptions, and complete system compromise.

Recommendation

Upgrade to lodash version 4.18.0 or later to patch CVE-2026-4800, which implements proper validation for options.imports.
Implement strict input validation on any data used to construct options.imports objects to prevent injection attacks.
Apply the workaround by only using developer-controlled, static key names in options.imports to avoid passing untrusted input as key names.
Deploy the Sigma rule Detect Lodash Template Injection via options.imports to identify potential exploitation attempts in your environment.

Incus Instance Template Vulnerability CVE-2026-33897

hello@craftedsignal.io — Thu, 26 Mar 2026 23:16:20 +0000

Incus, a system container and virtual machine manager, is vulnerable to arbitrary read and write access as root due to a flaw in its instance template handling. Prior to version 6.23.0, the application lacks proper chroot isolation when processing pongo2 templates. These templates, intended for file templating within instances during their lifecycle, bypass the expected chroot, granting access to the entire host filesystem with root privileges. This vulnerability, identified as CVE-2026-33897…

LiteLLM Server-Side Template Injection Vulnerability

hello@craftedsignal.io — Tue, 05 Nov 2024 12:00:00 +0000

A server-side template injection (SSTI) vulnerability has been identified in LiteLLM versions 1.80.5 up to, but not including, 1.83.7. This flaw resides within the /prompts/test endpoint, which processes user-supplied prompt templates. Due to insufficient input sanitization, a malicious actor with a valid proxy API key can inject arbitrary code into the template, leading to its execution within the LiteLLM Proxy process. This vulnerability was disclosed on April 24, 2026. Successful exploitation can compromise the proxy’s environment, potentially exposing sensitive credentials like provider API keys and database passwords, or allowing arbitrary command execution on the host system. Organizations using affected versions of LiteLLM are at risk. The vulnerability is addressed in version 1.83.7-stable by implementing a sandboxed template renderer.

Attack Chain

An attacker authenticates to the LiteLLM proxy server using a valid API key.
The attacker crafts a malicious prompt template containing SSTI payloads.
The attacker sends a POST request to the /prompts/test endpoint, including the crafted template in the request body.
The LiteLLM proxy server receives the request and processes the template without proper sanitization.
The SSTI payload executes arbitrary code within the LiteLLM proxy process.
The attacker gains access to environment variables containing sensitive information, such as API keys and database credentials.
The attacker uses the exposed credentials to gain unauthorized access to external services or data.
The attacker executes arbitrary commands on the host system, potentially leading to full system compromise.

Impact

Successful exploitation of this SSTI vulnerability allows attackers to execute arbitrary code within the LiteLLM Proxy process. This can lead to the exposure of sensitive information such as API keys and database credentials, potentially enabling unauthorized access to other systems and data. Furthermore, attackers can execute arbitrary commands on the host, leading to full system compromise. The impact is significant for organizations relying on LiteLLM for managing and routing AI model requests, as it could result in data breaches, service disruption, and reputational damage.

Recommendation

Upgrade LiteLLM to version 1.83.7-stable or later to patch the vulnerability, as this version implements a sandboxed template renderer (see Patches).
As a temporary workaround, block POST /prompts/test at your reverse proxy or API gateway to prevent exploitation attempts (see Workarounds).
Review and rotate API keys that should not have access to prompt management routes to limit the potential impact of compromised keys (see Workarounds).
Deploy the Sigma rule “Detect LiteLLM SSTI Attempts via /prompts/test” to your SIEM to identify potential exploitation attempts based on HTTP request patterns.

Thymeleaf Server-Side Template Injection Vulnerability

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A critical security vulnerability, CVE-2026-41901, has been identified in Thymeleaf, a Java template engine, affecting versions up to and including 3.1.4.RELEASE. This vulnerability allows for Server-Side Template Injection (SSTI) due to the improper neutralization of specific syntax patterns within sandboxed expression execution. Specifically, the library fails to properly sanitize certain constructs, allowing potentially dangerous expressions to be executed even within supposedly restricted contexts. This poses a significant risk if application developers pass unsanitized variables to the template engine and these variables are then utilized in sandboxed areas within the templates. Successful exploitation can lead to arbitrary code execution on the server. All users of affected versions are strongly advised to upgrade to version 3.1.5.RELEASE as soon as possible.

Attack Chain

An attacker identifies an application using a vulnerable version of Thymeleaf (<= 3.1.4.RELEASE).
The attacker locates a template within the application that uses Thymeleaf’s expression evaluation within a sandboxed context.
The attacker identifies an input field or parameter that passes data to the Thymeleaf template engine.
The attacker crafts a malicious payload containing a Thymeleaf expression designed to bypass the sandbox restrictions. This payload may utilize specific syntax patterns not properly neutralized by the vulnerable Thymeleaf version.
The attacker injects the crafted payload into the identified input field.
The application processes the attacker-controlled input via the Thymeleaf template engine.
Due to the vulnerability, the malicious Thymeleaf expression is executed despite the intended sandboxing.
The attacker achieves arbitrary code execution on the server, potentially gaining full control of the system.

Impact

Successful exploitation of CVE-2026-41901 can lead to complete system compromise. An attacker could potentially execute arbitrary code, install malware, steal sensitive data, or disrupt application services. The vulnerability affects any application using Thymeleaf versions up to 3.1.4.RELEASE, potentially impacting numerous organizations across various sectors. The lack of proper input sanitization is the root cause, which can be difficult to identify and mitigate without patching the underlying Thymeleaf library.

Recommendation

Immediately upgrade Thymeleaf to version 3.1.5.RELEASE or later to patch CVE-2026-41901.
If immediate patching is not feasible, review and sanitize all data passed to the Thymeleaf template engine to prevent the injection of malicious expressions. However, this workaround is not a complete solution and upgrading is strongly recommended.
Deploy the Sigma rule “Detect Suspicious Thymeleaf Template Injection Attempts” to identify potential exploitation attempts in web server logs, focusing on HTTP requests containing suspicious patterns related to Thymeleaf expressions.
Enable verbose logging on your web servers to capture detailed information about HTTP requests and responses, which can aid in identifying and investigating potential template injection attacks.

liquidjs Denial of Service via Circular Block Reference

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The liquidjs template engine, in versions prior to 10.25.7, is vulnerable to a denial-of-service (DoS) attack. This vulnerability stems from the improper handling of circular block references within the {% layout %} and {% block %} tags. When a template contains a nested block with the same name as an outer block, the rendering process enters an infinite recursive loop. This loop rapidly consumes available memory, leading to a “JavaScript heap out of memory” error and the subsequent crashing of the Node.js process. The vulnerability allows any user capable of submitting a Liquid template to trigger the DoS. This is especially concerning for CMS platforms, email template builders, and multi-tenant SaaS products.

Attack Chain

An attacker crafts a malicious Liquid template containing circular block references, specifically nesting a block with the same name inside another block. For example, {% block a %}outer-a {% block a %}inner-a{% endblock %}{% endblock %}.
The attacker submits this crafted template to an application that uses liquidjs for template rendering. This could be a CMS, email template builder, or any platform allowing user-provided Liquid templates.
The application’s liquidjs engine begins rendering the template.
During the rendering process, the engine encounters the nested block structure.
The engine attempts to resolve the block references, resulting in a recursive call to the same block’s render function.
This recursive call creates an infinite loop, as the inner block continuously calls the outer block’s render function, and vice versa.
The infinite loop causes uncontrolled memory allocation, rapidly consuming all available system memory (up to ~4GB).
The Node.js process running the liquidjs engine crashes with a “FATAL ERROR: JavaScript heap out of memory” error, leading to a denial of service.

Impact

Successful exploitation of this vulnerability leads to a denial of service (DoS). Any application that accepts user-provided or user-influenced Liquid templates can be crashed by a single malicious template. The Node.js process is terminated by the operating system due to memory exhaustion, resulting in complete service disruption. The number of potential victims is large, including CMS platforms, email template builders, multi-tenant SaaS products, and static site generators with untrusted input.

Recommendation

Upgrade to liquidjs version 10.25.7 or later to patch CVE-2026-41311.
Implement input validation and sanitization for Liquid templates to prevent the submission of malicious code.
Monitor Node.js processes for excessive memory consumption, which could indicate a DoS attack.
Deploy the Sigma rule Detect LiquidJS Template DoS to identify potentially malicious templates based on nested block structures.

Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Beghelli Sicuro24 SicuroWeb is vulnerable due to its inclusion of AngularJS version 1.5.2, which is an end-of-life component with known sandbox escape primitives. This vulnerability, tracked as CVE-2026-41468, can be exploited via template injection present within the SicuroWeb application. When combined, these vulnerabilities allow a network-adjacent attacker to bypass the AngularJS sandbox and achieve arbitrary JavaScript execution within the browser sessions of SicuroWeb operators. The attack is facilitated by plaintext HTTP deployments, where a man-in-the-middle (MITM) attacker can inject the malicious payload without requiring active user interaction. This issue exposes operators to potential session hijacking, DOM manipulation, and persistent browser compromise.

Attack Chain

Attacker positions themselves as a Man-in-the-Middle (MITM) on the network.
Operator initiates a session with the vulnerable Beghelli Sicuro24 SicuroWeb application over plaintext HTTP.
The MITM attacker intercepts the HTTP traffic between the operator and the SicuroWeb application.
The attacker injects a malicious AngularJS template injection payload into the HTTP response destined for the operator’s browser.
The operator’s browser processes the injected HTTP response, rendering the malicious AngularJS template.
The injected AngularJS template leverages known sandbox escape primitives present in AngularJS 1.5.2.
The sandbox escape allows the attacker to execute arbitrary JavaScript code within the operator’s browser session.
The attacker uses the arbitrary JavaScript execution to perform actions such as session hijacking, DOM manipulation for credential harvesting, or establishing persistent browser compromise.

Impact

Successful exploitation of CVE-2026-41468 can lead to significant compromise of Beghelli Sicuro24 SicuroWeb operator sessions. An attacker can hijack active sessions, steal credentials through DOM manipulation, or establish persistent control over the operator’s browser. Due to the lack of specific victim numbers or sector targeting information, the potential scope of damage is difficult to quantify but highly dependent on the privileges associated with compromised operator accounts. A successful attack could enable unauthorized access to sensitive data, system configurations, or control functions managed by the SicuroWeb application.

Recommendation

Deploy the Sigma rule Detect Suspicious AngularJS Template Injection to identify potential exploitation attempts against web applications leveraging AngularJS, focusing on HTTP requests containing suspicious template expressions.
Implement network monitoring for HTTP traffic to detect potential MITM attacks, focusing on connections to the SicuroWeb application, using the rule Detect Plaintext HTTP Traffic.
Upgrade Beghelli Sicuro24 SicuroWeb to a version that no longer utilizes AngularJS 1.5.2 or implement a robust Content Security Policy (CSP) to mitigate the impact of potential template injection attacks.