LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host. This issue has been patched in version 1.83.7.
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-41318 is a stored cross-site scripting (XSS) vulnerability in Mintplex-Labs' AnythingLLM application versions prior to 1.12.1. The issue arises from unsafe handling of markdown image alt text in the in-chat markdown renderer, specifically in the Chartable component, which does not sanitize chart captions. An attacker able to influence the LLM's output can inject malicious scripts that execute in other users' browsers when they view the affected chat. Version 1.12.1 includes a patch addressing this vulnerability.
CVE-2026-34587 is a high-severity vulnerability in the Kirby CMS prior to versions 4.9.0 and 5.4.0. It involves improper neutralization of special elements in the template engine related to user permissions. Specifically, authenticated users with the pages.create permission could bypass the intended editorial workflow by creating published pages directly via the REST API, overriding the isDraft flag. This bypass occurs because the changeStatus permission was not enforced on page creation through the API. The issue has been fixed in Kirby versions 4.
The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.
Thymeleaf versions 3.1.3.RELEASE and earlier contain a Server-Side Template Injection (SSTI) vulnerability due to improper neutralization of expression language syntax. This allows an unauthenticated remote attacker to bypass security mechanisms and execute unauthorized expressions if unvalidated user input is passed directly to the template engine. The issue is fixed in version 3.1.4.RELEASE.
CVE-2026-40477 is a critical Server-Side Template Injection (SSTI) vulnerability in Thymeleaf, a Java template engine. Versions 3.1.3.RELEASE and earlier improperly restrict access to objects within templates, allowing unauthenticated remote attackers to bypass protections and access sensitive objects if unvalidated user input is passed to the template engine. This flaw is fixed in version 3.1.4.RELEASE.
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted source, a crafted rule string could achieve arbitrary code execution. Exploitation requires write access to a check definition and subsequent execution of the test suite. This issue has been fixed in giskard-checks version 1.0.2b1.
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate those expressions during formatting. Second, f-string validation based on parsed top-level field names did not reject nested replacement fields inside format specifiers. In this pattern, the nested replacement field appears in the format specifier rather than in the top-level field name. As a result, earlier validation based on parsed field names did not reject the template even though Python formatting would still attempt to resolve the nested expression at runtime. This vulnerability is fixed in 0.3.84 and 1.2.28.
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary JavaScript in the context of the OpenCTI platform process during notifier template execution. This vulnerability is fixed in 6.9.5.
CVE-2026-26026 is a critical vulnerability in the GLPI IT management software versions 11.0.0 up to but not including 11.0.6. It involves improper control of code generation (CWE-94) allowing an administrator to perform template injection that leads to remote code execution (RCE). This vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. The issue is fixed in version 11.0.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1.
Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1.
nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/channels/email.py`), allowing a remote, unauthenticated attacker to execute arbitrary LLM instructions (and subsequently, system tools) without any interaction from the bot owner. By sending an email containing malicious prompts to the bot's monitored email address, the bot automatically polls, ingests, and processes the email content as highly trusted input, fully bypassing channel isolation and resulting in a stealthy, zero-click attack. Version 0.1.6 patches the issue.
CVE-2026-33897 is a critical vulnerability in the lxc incus container and virtual machine manager prior to version 6.23.0. It involves improper neutralization of special elements in the pongo2 template engine used within instances, allowing arbitrary read and write operations on the host filesystem with root privileges. The vulnerability arises because the pongo2 chroot isolation mechanism is bypassed, enabling templates to access and modify the entire system filesystem. This flaw has a CVSS score of 10, indicating a critical severity. Version 6.23.0 of incus includes a patch that addresses this issue.
CVE-2026-33130 is a medium-severity vulnerability in Uptime Kuma versions 1.23.0 through 2.2.0 that allows attackers with limited privileges to read arbitrary files on the server. The issue arises from improper control of filename inclusion in the LiquidJS template engine, specifically in the require.resolve() fallback mechanism, which lacks containment checks for unquoted absolute paths. This flaw enables remote file inclusion (RFI) attacks, potentially exposing sensitive server files such as /etc/passwd. The vulnerability does not require user interaction but does require some level of privileges (PR:L). It was fixed in version 2.
Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. This issue has been patched in version 3.2.0.