Threats affecting pkg:github/DataGerry

DataGerry versions prior to 3.3.0 contain a server-side template injection vulnerability that allows authenticated users with specific permissions to execute arbitrary operating system commands. This is achieved by injecting malicious Jinja2 payloads into a template field that is rendered without sandboxing, leading to remote code execution as the web process user, which is root in default Docker setups. The vulnerability is fixed in version 3.3.0.