Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template expressions such as event() in those values, and the workflow engine evaluates them when the persistent workflow runs. When the workflow has a valid Slack connector, the resulting Slack action can disclose event or tenant metadata to an attacker-selected channel; the shipped placeholder connection does not deliver messages by itself. The workflow remains in the tenant after the MCP session and credentials are gone. The isPrivate option defaults to false, making the created workflow tenant-visible unless the caller changes it. Exploitation requires either an MCP prompt-injection path or an operator approving a prompt that displays the template fragment literally. This issue is fixed in version 2.0.0.
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability.
The specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889.
GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access handler in src/transform.ts does not reject meta-properties, src/compilers/javascript.ts emits the surviving property directly, and src/parser.ts accepts constructor as an ordinary identifier. The resulting generated JavaScript executes attacker-selected code in the host runtime. This permits browser script execution and session compromise on the auto-running playground and arbitrary Node.js code execution on library, CI, or DevOps hosts. This plain-string path is distinct from the programmatic AST-object injection issue. This issue is fixed in version 1.0.1.
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.
CVE-2026-119085 is a high-severity vulnerability in the publishing component of Amazon Virtual Engineering Workbench (VEW) caused by improper neutralization of special elements in its template engine. A remote authenticated attacker can exploit this flaw by submitting a crafted CloudFormation template containing malicious template engine directives via the product versioning API. Successful exploitation allows arbitrary code execution with the permissions of the publishing Lambda's IAM role, potentially exposing data and resources across all tenant projects. AWS has provided a fix in a newer version of the software and recommends redeploying from the latest version of awslabs/virtual-engineering-workbench to remediate the issue.
CVE-2026-107259 is a vulnerability in the Drupal Linked Field module affecting versions from 0.0.0 up to but not including 1.8.0. It involves improper neutralization of special elements used in a template engine, which can lead to code injection. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 1.8.0.
CVE-2026-107264 is a vulnerability in the Drupal Inline Formatter Field module that allows code injection due to improper neutralization of special elements in its template engine. This flaw affects versions from 0.0.0 up to but not including 4.2.0. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 4.2.0.
CVE-2026-61707 is a critical code injection vulnerability in SOCFortress CoPilot prior to version 0.1.76. It arises from the ability of low-privilege users to upload Jinja2 templates that are later executed without sandboxing by privileged users, enabling remote code execution. The vulnerability allows attackers to execute arbitrary Python code on the backend with root privileges, exposing sensitive tenant data and credentials. The issue is fixed in version 0.1.76.
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
CVE-2026-115189 is a server-side template injection vulnerability in the Twig theme rendering sandbox of Mautic. It allows an authenticated user with the core:themes:create permission to upload a malicious theme template that escapes sandbox restrictions. This leads to arbitrary code execution on the server with web server privileges, enabling execution of OS commands, file read/write, and access to internal services. The vulnerability affects multiple Mautic versions prior to fixed releases and is an incomplete fix of a previous vulnerability.
CVE-2026-115938 is a high-severity vulnerability in Craft CMS that allows authenticated control panel users to exploit improper neutralization of special elements in the Twig template engine. The flaw enables bypassing sandbox restrictions via repeated single-segment property lookups, leading to leakage of the GeneralConfig::securityKey. This key can then be used to forge signed parameters, which are rendered unsandboxed, allowing invocation of native PHP callables. The vulnerability affects Craft CMS versions 4.0.0 up to but not including 4.18.9 and 5.0.0 up to but not including 5.11.2. Fixed versions are 4.18.9 and 5.11.2.
CVE-2026-55486 is a critical cross-site scripting (XSS) vulnerability in the intranda goobi-viewer-core web application. It affects versions from 25.08 up to but not including 26.05. The vulnerability arises because the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without proper validation, which is then embedded unsafely into the Content-Security-Policy header and HTML response body, enabling reflected XSS attacks. The issue has been fixed in version 26.05.
CVE-2026-96355 is a critical vulnerability in the Drupal Webform module caused by improper neutralization of special elements used in its template engine. This flaw allows an attacker to perform code injection, potentially leading to full compromise of the affected system. The vulnerability affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. Fixed versions 6.2.12 and 6.3.1 address this issue.
CVE-2026-96392 is a vulnerability in the Drupal AI CKEditor component that allows code injection due to improper neutralization of special elements used in its template engine. This affects AI CKEditor versions from 0.0.0 up to but not including 1.4.3. The vulnerability has a low CVSS score of 3.5 and does not impact confidentiality, integrity, or availability significantly. A fix is available in version 1.4.3.
CVE-2026-78164 is a high-severity vulnerability in Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components. It involves improper neutralization of special elements used in a template engine, allowing inbound messages to override endpoint URIs via headers that are processed through a property-placeholder resolution mechanism. This can lead to exposure of sensitive information and unintended configuration or bean method invocation. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, with 4.23.0 recommended for the latest fixes. Mitigations include upgrading to fixed versions or stripping override headers at the trust boundary, or setting skipControlHeaders=true on camel-http endpoints. The vulnerability is not mitigated by bridgeEndpoint=true or percent-encoding placeholder delimiters.