Vulnerability-Lookup

GHSA-WJ7R-P6PM-XX2R

Vulnerability from github – Published: 2024-06-17 15:30 – Updated: 2024-08-01 15:31

Details

StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-37621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-97"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-17T14:15:11Z",
    "severity": "HIGH"
  },
  "details": "StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.",
  "id": "GHSA-wj7r-p6pm-xx2r",
  "modified": "2024-08-01T15:31:49Z",
  "published": "2024-06-17T15:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37621"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Hebing123/cve/issues/47"
    },
    {
      "type": "WEB",
      "url": "https://www.strongshop.cn"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WJV6-JCFJ-MF9R

Vulnerability from github – Published: 2026-07-28 21:50 – Updated: 2026-07-28 21:50

Summary

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

Details

Summary

datamodel-code-generator is vulnerable to code injection when a developer passes an --extra-template-data file whose comment value contains a literal \r (carriage return). The comment variable is rendered into a Python # comment in six built-in templates with no line-terminator escaping. Python's tokenizer treats a bare CR as a physical-line terminator (see Python language reference — Physical lines), so the comment ends at the \r and the text after it is parsed as Python, including, when the CR is followed by suitable indentation, as a statement within the class body that follows on the next template line.

Details

The vulnerable templates each contain # {{ comment }} with no escaping:

src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2:12 and :19
src/datamodel_code_generator/model/template/TypeAliasType.jinja2:12 and :19
src/datamodel_code_generator/model/template/TypeStatement.jinja2:12 and :19
src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2:4
src/datamodel_code_generator/model/template/pydantic_v2/RootModel.jinja2:19
src/datamodel_code_generator/model/template/pydantic_v2/RootModelTypeAlias.jinja2:13

The pydantic_v2/BaseModel.jinja2:4 site is representative:

class {{ class_name }}({{ base_class }}):{% if comment is defined %}  # {{ comment }}{% endif %}

When the developer-supplied extras file populates comment for a model, the value reaches the template via DataModel.extra_template_data (set in src/datamodel_code_generator/model/base.py:736-742) and Jinja2 interpolates it raw. None of the templates use comment_safe, escape_docstring, or any other line-terminator filter.

PoC

Complete self contained POC is available at my secret gist: https://gist.github.com/thegr1ffyn/8ad6b8cb3cc2be9d3a0144aeb6896a3f

Impact

Who's affected: any developer or CI pipeline that runs datamodel-codegen --extra-template-data <file> where the extras file is influenced by attacker-controlled input. Realistic scenarios include:
Extras file generated from a third-party schema-annotation system.
Extras file vendored from an upstream repository.
Extras file produced by a script that merges multiple comment sources.
Build pipelines that template the extras file from environment variables, ticket descriptions, or commit metadata.
What it gains: arbitrary Python code execution in the importer's process at import time.
What it does NOT need: the schema itself can be entirely benign; only the extras file needs to contain the malicious comment.
What does block it: not passing --extra-template-data, or rejecting extras files whose comment values contain \r, \x0b, or \x0c before invocation.

Resolution

The fix normalizes comment values from built-in --extra-template-data before template rendering. Inline comments now convert CRLF, bare CR, vertical tab, and form feed into LF and prefix continuation lines with #, so attacker-controlled text stays inside the generated Python comment block.

Remediation

Upgrade to datamodel-code-generator 0.60.2 or later.

This issue affects datamodel-code-generator versions >= 0.14.1, <= 0.60.1 and is fixed in 0.60.2.

Submitted by: Hamza Haroon (thegr1ffyn)

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.60.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "datamodel-code-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.14.1"
            },
            {
              "fixed": "0.60.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T21:50:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`datamodel-code-generator` is vulnerable to code injection when a developer passes an `--extra-template-data` file whose `comment` value contains a literal `\\r` (carriage return). The `comment` variable is rendered into a Python `#` comment in six built-in templates with **no** line-terminator escaping. Python\u0027s tokenizer treats a bare CR as a physical-line terminator (see [Python language reference \u2014 Physical lines](https://docs.python.org/3/reference/lexical_analysis.html#physical-lines)), so the comment ends at the `\\r` and the text after it is parsed as Python, including, when the CR is followed by suitable indentation, as a statement within the class body that follows on the next template line.\n\n### Details\n\nThe vulnerable templates each contain `# {{ comment }}` with no escaping:\n\n- `src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2:12` and `:19`\n- `src/datamodel_code_generator/model/template/TypeAliasType.jinja2:12` and `:19`\n- `src/datamodel_code_generator/model/template/TypeStatement.jinja2:12` and `:19`\n- `src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2:4`\n- `src/datamodel_code_generator/model/template/pydantic_v2/RootModel.jinja2:19`\n- `src/datamodel_code_generator/model/template/pydantic_v2/RootModelTypeAlias.jinja2:13`\n\nThe `pydantic_v2/BaseModel.jinja2:4` site is representative:\n\n```jinja2\nclass {{ class_name }}({{ base_class }}):{% if comment is defined %}  # {{ comment }}{% endif %}\n```\n\nWhen the developer-supplied extras file populates `comment` for a model, the value reaches the template via `DataModel.extra_template_data` (set in `src/datamodel_code_generator/model/base.py:736-742`) and Jinja2 interpolates it raw. None of the templates use `comment_safe`, `escape_docstring`, or any other line-terminator filter.\n\n### PoC\nComplete self contained POC is available at my secret gist: https://gist.github.com/thegr1ffyn/8ad6b8cb3cc2be9d3a0144aeb6896a3f\n\n### Impact\n\n- **Who\u0027s affected**: any developer or CI pipeline that runs `datamodel-codegen --extra-template-data \u003cfile\u003e` where the extras file is influenced by attacker-controlled input. Realistic scenarios include:\n  - Extras file generated from a third-party schema-annotation system.\n  - Extras file vendored from an upstream repository.\n  - Extras file produced by a script that merges multiple `comment` sources.\n  - Build pipelines that template the extras file from environment variables, ticket descriptions, or commit metadata.\n- **What it gains**: arbitrary Python code execution in the importer\u0027s process at `import` time.\n- **What it does NOT need**: the schema itself can be entirely benign; only the extras file needs to contain the malicious `comment`.\n- **What does block it**: not passing `--extra-template-data`, or rejecting extras files whose `comment` values contain `\\r`, `\\x0b`, or `\\x0c` before invocation.\n\n### Resolution\n\nThe fix normalizes `comment` values from built-in `--extra-template-data` before template rendering. Inline comments now convert CRLF, bare CR, vertical tab, and form feed into LF and prefix continuation lines with `# `, so attacker-controlled text stays inside the generated Python comment block.\n\n### Remediation\n\nUpgrade to `datamodel-code-generator` `0.60.2` or later.\n\nThis issue affects `datamodel-code-generator` versions `\u003e= 0.14.1, \u003c= 0.60.1` and is fixed in `0.60.2`.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-wjv6-jcfj-mf9r",
  "modified": "2026-07-28T21:50:09Z",
  "published": "2026-07-28T21:50:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/b73abb5cd703a50471b8950bbd3bd0b82ad71de7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koxudaxi/datamodel-code-generator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field"
}

GHSA-WJW6-95H5-4JPX

Vulnerability from github – Published: 2025-06-10 20:17 – Updated: 2026-06-08 20:18

Summary

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Details

Impact

What kind of vulnerability is it? Who is impacted?

All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.

Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:

A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.
A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.

Patches

Has the problem been patched? What versions should users upgrade to?

Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:

extras.add_secret
extras.change_secret
extras.view_secret
extras.add_computedfield
extras.change_computedfield
extras.add_customlink
extras.change_customlink
extras.add_jobbutton
extras.change_jobbutton

References

Are there any links users can visit to find out more?

https://jinja.palletsprojects.com/en/stable/sandbox/
https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description
https://github.com/nautobot/nautobot/pull/7417
https://github.com/nautobot/nautobot/pull/7429

Severity

6.0 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.4.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-10T20:17:15Z",
    "nvd_published_at": "2025-06-10T16:15:42Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAll users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.\n\nDue to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:\n\n1. A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.\n2. A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nNautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:\n\n- `extras.add_secret`\n- `extras.change_secret`\n- `extras.view_secret`\n- `extras.add_computedfield`\n- `extras.change_computedfield`\n- `extras.add_customlink`\n- `extras.change_customlink`\n- `extras.add_jobbutton`\n- `extras.change_jobbutton`\n\n### References\n_Are there any links users can visit to find out more?_\n\n- https://jinja.palletsprojects.com/en/stable/sandbox/\n- https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description\n- https://github.com/nautobot/nautobot/pull/7417\n- https://github.com/nautobot/nautobot/pull/7429",
  "id": "GHSA-wjw6-95h5-4jpx",
  "modified": "2026-06-08T20:18:22Z",
  "published": "2025-06-10T20:17:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49142"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/7417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/7429"
    },
    {
      "type": "WEB",
      "url": "https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nautobot/nautobot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2025-74.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2025-79.yaml"
    },
    {
      "type": "WEB",
      "url": "https://jinja.palletsprojects.com/en/stable/sandbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating"
}

GHSA-WQC2-GWGP-9P7W

Vulnerability from github – Published: 2024-09-27 18:32 – Updated: 2024-09-27 21:31

Details

A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-46366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-27T17:15:13Z",
    "severity": "HIGH"
  },
  "details": "A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.",
  "id": "GHSA-wqc2-gwgp-9p7w",
  "modified": "2024-09-27T21:31:50Z",
  "published": "2024-09-27T18:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46366"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WRPQ-J7Q3-24J7

Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32

Details

Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-66613"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T13:17:50Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated Remote Code Execution (RCE) in JetEngine \u003c= 3.8.14 versions.",
  "id": "GHSA-wrpq-j7q3-24j7",
  "modified": "2026-08-19T15:32:23Z",
  "published": "2026-08-19T15:32:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66613"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X238-V9F9-93G8

Vulnerability from github – Published: 2025-04-28 15:31 – Updated: 2025-04-28 15:31

Details

Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.

Severity

2.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-23376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-28T15:15:45Z",
    "severity": "LOW"
  },
  "details": "Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.",
  "id": "GHSA-x238-v9f9-93g8",
  "modified": "2025-04-28T15:31:41Z",
  "published": "2025-04-28T15:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23376"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000311083/dsa-2025-062-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X67C-8PWR-M8G3

Vulnerability from github – Published: 2026-09-03 22:49 – Updated: 2026-09-03 22:49

Summary

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

Details

CVE: This vulnerability corresponds to CVE-2026-72807.

Summary

Attribute-view (AV) template columns are live-evaluated on every render and expose the queryBlocks template function, which runs raw SQL on the read-write database handle (SelectBlocksRawStmt, using ?→argument string substitution rather than parameter binding). AV mutations are admin-gated, so this is not directly reader-injectable but it is a second-order vector: an attacker distributes a SiYuan document or AV package whose template column contains .action{queryBlocks "<arbitrary SQL>"} when a victim imports the package and renders the AV, the attacker's SQL executes on the victim's kernel (read and, via statement stacking, write).

Details

Doc-level {{…}} templates are rendered at insert-time and become static, so they are not re-evaluated on reader view. The residual is AV template columns, which are live-evaluated at render. queryBlocks passes its argument to SelectBlocksRawStmt with ?→arg string substitution, not a bound parameter, on the main read-write handle (88250/go-sqlite3 fork, statement-stacking capable) so an attacker-controlled template argument becomes arbitrary SQL.

The SSTI surface is otherwise hardened: BuiltInTemplateFuncs deletes env, expandenv, and getHostByName so there is no environment/host/file/exec SSTI. queryBlocks-to-SQL is the remaining live-evaluated sink.

Proof of Concept

An AV template column set to .action{queryBlocks "<sql>"} executes <sql> against the read-write handle when the AV is rendered. Delivered second-order: a shared/imported document or AV package carrying such a column runs the embedded SQL on any kernel that imports and renders it.

Proof of Concept

Reproduced on a live instance.

1. Host doc + AV (admin, 6806):

POST /api/filetree/createDocWithMd {notebook, path:"/ssti-poc", markdown:"host"}  → DOC
POST /api/av/renderAttributeView   {id:"<AV>"}   # materializes the AV

2. Plant the malicious template column (one performTransactions call):

{"reqId":1,"session":"poc","transactions":[{"doOperations":[
  {"action":"addAttrViewCol","avID":"<AV>","id":"<COL>","name":"tpl","type":"template"},
  {"action":"updateAttrViewColTemplate","avID":"<AV>","id":"<COL>","type":"template",
   "data":".action{range queryBlocks \"SELECT * FROM blocks WHERE root_id='<PROTECTED_DOC_ID>'\"}.action{.Markdown} .action{end}"},
  {"action":"insertAttrViewBlock","avID":"<AV>","isDetached":true}
]}]}

3. Trigger (render evaluates the template):

POST /api/av/renderAttributeView {id:"<AV>"}

Result: the template cell renders ## LockedSection TOP_SECRET… the queryBlocks SQL executed and returned the password-protected document's content, arbitrary SQL via template reading across the publish/password boundary. queryBlocks uses ?→arg string substitution (not parameterized), so UNION and stacked writes are also possible. Delivered second-order, the same column executes on any kernel that imports and renders the AV.

Impact

An attacker who gets a victim to import a crafted document/AV package and render it achieves arbitrary SQL execution on the victim's kernel cross-notebook read and via stacking, write. Precondition is content delivery plus render (import of an attacker-supplied package), which bounds severity to Medium. Not directly reachable by an anonymous reader (AV creation is admin-gated); the injection travels in stored/imported template content.

Suggested fix

Parameterize queryBlocks bind the argument rather than substituting it into the SQL string or restrict the template function set available in AV columns as was done for the doc-template functions. Treat imported template content as untrusted at render time.

Severity

8.0 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260723035036-0a176345e02a"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72807"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T22:49:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**CVE:** This vulnerability corresponds to [CVE-2026-72807](https://nvd.nist.gov/vuln/detail/CVE-2026-72807).\n\n### Summary\n\nAttribute-view (AV) template columns are live-evaluated on every render and expose the `queryBlocks` template function, which runs raw SQL on the read-write database handle (`SelectBlocksRawStmt`, using `?`\u2192argument string substitution rather than parameter binding). AV mutations are admin-gated, so this is not directly reader-injectable but it is a second-order vector: an attacker distributes a SiYuan document or AV package whose template column contains `.action{queryBlocks \"\u003carbitrary SQL\u003e\"}` when a victim imports the package and renders the AV, the attacker\u0027s SQL executes on the victim\u0027s kernel (read and, via statement stacking, write).\n\n### Details\n\nDoc-level `{{\u2026}}` templates are rendered at insert-time and become static, so they are not re-evaluated on reader view. The residual is AV template columns, which are live-evaluated at render. `queryBlocks` passes its argument to `SelectBlocksRawStmt` with `?`\u2192arg string substitution, not a bound parameter, on the main read-write handle (`88250/go-sqlite3` fork, statement-stacking capable) so an attacker-controlled template argument becomes arbitrary SQL.\n\nThe SSTI surface is otherwise hardened: `BuiltInTemplateFuncs` deletes `env`, `expandenv`, and `getHostByName` so there is no environment/host/file/exec SSTI. `queryBlocks`-to-SQL is the remaining live-evaluated sink.\n\n### Proof of Concept\n\nAn AV template column set to `.action{queryBlocks \"\u003csql\u003e\"}` executes `\u003csql\u003e` against the read-write handle when the AV is rendered. Delivered second-order: a shared/imported document or AV package carrying such a column runs the embedded SQL on any kernel that imports and renders it.\n\n### Proof of Concept\n\nReproduced on a live instance.\n\n**1. Host doc + AV (admin, 6806):**\n```\nPOST /api/filetree/createDocWithMd {notebook, path:\"/ssti-poc\", markdown:\"host\"}  \u2192 DOC\nPOST /api/av/renderAttributeView   {id:\"\u003cAV\u003e\"}   # materializes the AV\n```\n\n**2. Plant the malicious template column (one performTransactions call):**\n```json\n{\"reqId\":1,\"session\":\"poc\",\"transactions\":[{\"doOperations\":[\n  {\"action\":\"addAttrViewCol\",\"avID\":\"\u003cAV\u003e\",\"id\":\"\u003cCOL\u003e\",\"name\":\"tpl\",\"type\":\"template\"},\n  {\"action\":\"updateAttrViewColTemplate\",\"avID\":\"\u003cAV\u003e\",\"id\":\"\u003cCOL\u003e\",\"type\":\"template\",\n   \"data\":\".action{range queryBlocks \\\"SELECT * FROM blocks WHERE root_id=\u0027\u003cPROTECTED_DOC_ID\u003e\u0027\\\"}.action{.Markdown} .action{end}\"},\n  {\"action\":\"insertAttrViewBlock\",\"avID\":\"\u003cAV\u003e\",\"isDetached\":true}\n]}]}\n```\n\n**3. Trigger (render evaluates the template):**\n```\nPOST /api/av/renderAttributeView {id:\"\u003cAV\u003e\"}\n```\nResult: the template cell renders `## LockedSection TOP_SECRET\u2026` the `queryBlocks` SQL executed and returned the password-protected document\u0027s content, arbitrary SQL via template reading across the publish/password boundary. `queryBlocks` uses `?`\u2192arg string substitution (not parameterized), so UNION and stacked writes are also possible. Delivered second-order, the same column executes on any kernel that imports and renders the AV.\n\n### Impact\n\nAn attacker who gets a victim to import a crafted document/AV package and render it achieves arbitrary SQL execution on the victim\u0027s kernel cross-notebook read and via stacking, write. Precondition is content delivery plus render (import of an attacker-supplied package), which bounds severity to Medium. Not directly reachable by an anonymous reader (AV creation is admin-gated); the injection travels in stored/imported template content.\n\n### Suggested fix\n\nParameterize `queryBlocks` bind the argument rather than substituting it into the SQL string or restrict the template function set available in AV columns as was done for the doc-template functions. Treat imported template content as untrusted at render time.",
  "id": "GHSA-x67c-8pwr-m8g3",
  "modified": "2026-09-03T22:49:31Z",
  "published": "2026-09-03T22:49:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72807"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/0a176345e02a0d19bdc7762e50e0b92002087d20"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel"
}

GHSA-X7GR-MMJJ-HX3H

Vulnerability from github – Published: 2024-11-14 18:30 – Updated: 2026-04-01 18:32

Details

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.15.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-52393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-82",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-14T18:15:26Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.15.",
  "id": "GHSA-x7gr-mmjj-hx3h",
  "modified": "2026-04-01T18:32:24Z",
  "published": "2024-11-14T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52393"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/podlove-podcasting-plugin-for-wordpress/vulnerability/wordpress-podlove-podcast-publisher-plugin-4-1-15-admin-remote-code-execution-rce-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-1-15-admin-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X7M9-MWC2-G6W2

Vulnerability from github – Published: 2026-05-18 17:23 – Updated: 2026-06-09 10:32

Summary

Formie: Pre-authenticated server-side template injection in Hidden fields

Details

Impact

Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).
Sites with public Formie forms that include at least one Hidden field with that configuration.
No CP login for the reported chain.

Patches

2.2.20, 3.1.24

Workarounds

Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible
Otherwise, upgrade to patched versions

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "verbb/formie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-beta.1"
            },
            {
              "fixed": "3.1.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "verbb/formie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-693",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:23:39Z",
    "nvd_published_at": "2026-05-29T20:16:27Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n- Unauthenticated users could submit crafted values into Hidden fields (with Default value \u2192 Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior).\n- Sites with public Formie forms that include at least one Hidden field with that configuration.\n- No CP login for the reported chain.\n\n### Patches\n- [2.2.20](https://github.com/verbb/formie/releases/tag/2.2.20), [3.1.24](https://github.com/verbb/formie/releases/tag/3.1.24)\n\n### Workarounds\n- Temporarily remove Hidden fields from public forms or switch Hidden default away from Custom where feasible\n- Otherwise, upgrade to patched versions",
  "id": "GHSA-x7m9-mwc2-g6w2",
  "modified": "2026-06-09T10:32:38Z",
  "published": "2026-05-18T17:23:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/security/advisories/GHSA-x7m9-mwc2-g6w2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/commit/f690d5623163ce2a95da305238d6367575486ee3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/verbb/formie"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/releases/tag/2.2.20"
    },
    {
      "type": "WEB",
      "url": "https://github.com/verbb/formie/releases/tag/3.1.24"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Formie: Pre-authenticated server-side template injection in Hidden fields"
}

GHSA-XF73-GXC6-65VV

Vulnerability from github – Published: 2026-08-18 18:32 – Updated: 2026-08-18 18:32

Details

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection

Severity

7.6 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-71880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T18:19:33Z",
    "severity": "HIGH"
  },
  "details": "Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection",
  "id": "GHSA-xf73-gxc6-65vv",
  "modified": "2026-08-18T18:32:03Z",
  "published": "2026-08-18T18:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71880"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gbif/ipt/issues/3118"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0016.md"
    },
    {
      "type": "WEB",
      "url": "https://www.gbif.org/ipt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

GHSA-WJ7R-P6PM-XX2R

GHSA-WJV6-JCFJ-MF9R

Summary

Details

PoC

Impact

Resolution

Remediation

GHSA-WJW6-95H5-4JPX

Impact

Patches

Workarounds

References

GHSA-WQC2-GWGP-9P7W

GHSA-WRPQ-J7Q3-24J7

GHSA-X238-V9F9-93G8

GHSA-X67C-8PWR-M8G3

Summary

Details

Proof of Concept

Proof of Concept

Impact

Suggested fix

GHSA-X7GR-MMJJ-HX3H

GHSA-X7M9-MWC2-G6W2

Impact

Patches

Workarounds

GHSA-XF73-GXC6-65VV

Mitigation

Mitigation