Common Weakness Enumeration

CWE-1336

Allowed

Improper Neutralization of Special Elements Used in a Template Engine

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

458 vulnerabilities reference this CWE, most recent first.

GHSA-WHR7-M3F8-MPM8

Vulnerability from github – Published: 2023-06-16 19:37 – Updated: 2023-06-16 19:37
VLAI
Summary
Grav Server-side Template Injection (SSTI) via Twig Default Filters
Details

Hi,

actually we have sent the bug report to security@getgrav.org on 27th March 2023 and on 10th April 2023.

Grav Server-side Template Injection (SSTI) via Twig Default Filters

Summary:

Product Grav CMS
Vendor Grav
Severity High - Users with login access to Grav Admin panel and page creation/update permissions are able to obtain remote code/command execution
Affected Versions <= v1.7.40 (Commit 685d762) (Latest version as of writing)
Tested Versions v1.7.40
Internal Identifier STAR-2023-0008
CVE Identifier TBD
CWE(s) CWE-184: Incomplete List of Disallowed Inputs, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

CVSS3.1 Scoring System:

Base Score: 7.2 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
| Metric | Value | | ---------------------------- | --------- | | Attack Vector (AV) | Network | | Attack Complexity (AC) | Low | | Privileges Required (PR) | High | | User Interaction (UI) | None | | Scope (S) | Unchanged | | Confidentiality (C) | High | | Integrity (I) | High | | Availability (A) | High |

Product Overview:

Grav is a PHP-based flat-file content management system (CMS) designed to provide a fast and simple way to build websites. It supports rendering of web pages written in Markdown and Twig expressions, and provides an administration panel to manage the entire website via an optional Admin plugin.

Vulnerability Summary:

The patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter() function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution.

Vulnerability Details:

Twig comes with an extension known as the Core Extension that is enabled by default when initialising a new Twig environment. Twig's Core Extension provides multiple built-in filters, such as the filter() function, which can be used in Twig templates.

CVE-2022-2073 leverages the default filter() filter function in Twig to invoke arbitrary unsafe functions. This was patched by overriding the default filter() filter function in commit 9d6a2d of Grav v1.7.34 to perform validation checks on the arguments passed to filter(): ~~~diff php ... class GravExtension extends AbstractExtension implements GlobalsInterface { ... public function getFilters(): array { return [ ... // Security fix + new TwigFilter('filter', [$this, 'filterFilter'], ['needs_environment' => true]), ]; }

...
  • /**
    • @param Environment $env
    • @param array $array
    • @param callable|string $arrow
    • @return array|CallbackFilterIterator
    • @throws RuntimeError
  • */
  • function filterFilter(Environment $env, $array, $arrow)
  • {
  • if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
  • throw new RuntimeError('Twig |filter("' . $arrow . '") is not allowed.');
  • } +
  • return \twig_array_filter($env, $array, $arrow);
  • } }

However, looking at the source code of [/src/Extension/CoreExtension.php](https://github.com/twigphp/Twig/blob/v1.44.7/src/Extension/CoreExtension.php) of Twig, alternative default Twig filters could also be used invoke arbitrary functions:
~~~php
...
class CoreExtension extends AbstractExtension
{
    ...
    public function getFilters(): array
    {
        return [
            ...
            // array helpers
            ...
            new TwigFilter('filter', 'twig_array_filter', ['needs_environment' => true]), // unsafe
            new TwigFilter('map', 'twig_array_map', ['needs_environment' => true]), // unsafe
            new TwigFilter('reduce', 'twig_array_reduce', ['needs_environment' => true]), // unsafe
        ];
    }

The three filter functions above respectively call array_filter(), array_map() and array_reduce(). Since only filter() is being overriden by Grav to ensure that the callable passed to filter() does not result in the invocation of an unsafe function, the other two functions (i.e. map() and reduce()) could be used by an authenticated attacker that is able to inject and render malicious templates to gain remote code execution.

Exploit Conditions:

This vulnerability can be exploited if the attacker has access to: 1. an administrator account, or 2. a non-administrator, user account that are granted the following permissions: - login access to Grav admin panel, and - page creation or update rights

Reproduction Steps:

  1. Log in to Grav Admin using an administrator account.
  2. Navigate to Accounts > Add, and ensure that the following permissions are assigned when creating a new low-privileged user:
    • Login to Admin - Allowed
    • Page Update - Allowed
  3. Log out of Grav Admin, and log back in using the account created in step 2.
  4. Navigate to http://<grav_installation>/admin/pages/home.
  5. Click the Advanced tab and select the checkbox beside Twig to ensure that Twig processing is enabled for the modified webpage.
  6. Under the Content tab, insert the following payload within the editor: ~~~twig {{ ['id'] | map('system') }} {{ ['id'] | reduce('system') }} ~~~
  7. Click the Preview button. Observe that the output of the id shell command is returned in the preview.

Suggested Mitigations:

Override the built-in Twig map() and reduce() filter functions in system/src/Grav/Common/Twig/Extension/GravExtension.php to validate the argument passed to the filter in $arrow.

For example:

...
class GravExtension extends AbstractExtension implements GlobalsInterface
{
    ...
    public function getFilters(): array
    {
        return [
            ...
            // Security fix
            new TwigFilter('filter', [$this, 'filterFilter'], ['needs_environment' => true]),
+           new TwigFilter('map', [$this, 'mapFilter'], ['needs_environment' => true]),
+           new TwigFilter('reduce', [$this, 'reduceFilter'], ['needs_environment' => true]),
        ];
    }

    ...
+   /**
+    * @param Environment $env
+    * @param array $array
+    * @param callable|string $arrow
+    * @return array|CallbackFilterIterator
+    * @throws RuntimeError
+    */
+   function mapFilter(Environment $env, $array, $arrow)
+   {
+       if (!$arrow instanceof Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
+           throw new RuntimeError('Twig |map("' . $arrow . '") is not allowed.');
+       }
+
+       return \twig_array_map($env, $array, $arrow);
+   }
+ 
+   /**
+    * @param Environment $env
+    * @param array $array
+    * @param callable|string $arrow
+    * @return array|CallbackFilterIterator
+    * @throws RuntimeError
+    */
+   function reduceFilter(Environment $env, $array, $arrow)
+   {
+       if (!$arrow instanceof Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
+           throw new RuntimeError('Twig |reduce("' . $arrow . '") is not allowed.');
+       }
+
+       return \twig_array_reduce($env, $array, $arrow);
+   }
}

Detection Guidance:

The following strategies may be used to detect potential exploitation attempts. 1. Searching within Markdown pages using the following shell command:
grep -Priz -e '\|\s*(map|reduce)\s*\(' /path/to/webroot/user/pages/ 2. Searching within Doctrine cache data using the following shell command:
grep -Priz -e '\|\s*(map|reduce)\s*\(' --include '*.doctrinecache.data' /path/to/webroot/cache/ 3. Searching within Twig cache using the following shell command:
grep -Priz -e 'twig_array_(map|reduce)' /path/to/webroot/cache/twig/ 4. Searching within compiled Twig template files using the following shell command:
grep -Priz -e '\|\s*(map|reduce)\s*\(' /path/to/webroot/cache/compiled/files/

Note that it is not possible to detect indicators of compromise reliably using the Grav log file (located at /path/to/webroot/logs/grav.log by default), as successful exploitation attempts do not generate any additional logs. However, it is worthwhile to examine any PHP errors or warnings logged to determine the existence of any failed exploitation attempts.

Credits:

Ngo Wei Lin (@Creastery) & Wang Hengyue (@w_hy_04) of STAR Labs SG Pte. Ltd. (@starlabs_sg)

Vulnerability Disclosure:

This vulnerability report is subject to a 120 day disclosure deadline as per STAR Labs SG Pte. Ltd.'s Vulnerability Disclosure Policy. After 120 days have elapsed, the vulnerability report will be published to the public by STAR Labs SG Pte. Ltd. (STAR Labs).

The scheduled disclosure date is 25th July, 2023. Disclosure at an earlier date is also possible if agreed upon by all parties.

Kindly note that STAR Labs reserved and assigned the following CVE identifiers to the respective vulnerabilities presented in this report:
1. CVE-2023-30596 Server-side Template Injection (SSTI) in getgrav/grav <= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in GravExtension.filterFilter() and to achieve remote code execution via Twig's default filters map() and reduce(). This is a bypass of CVE-2022-2073.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-34448"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-16T19:37:08Z",
    "nvd_published_at": "2023-06-14T23:15:11Z",
    "severity": "HIGH"
  },
  "details": "Hi,\n\nactually we have sent the bug report to [security@getgrav.org](mailto:security@getgrav.org) on 27th March 2023 and on 10th April 2023.\n\n# Grav Server-side Template Injection (SSTI) via Twig Default Filters\n\n## Summary:  \n| **Product**             | Grav CMS                                      |\n| ----------------------- | --------------------------------------------- |\n| **Vendor**              | Grav                                          |\n| **Severity**            | High - Users with login access to Grav Admin panel and page creation/update permissions are able to obtain remote code/command execution |\n| **Affected Versions**   | \u003c= [v1.7.40](https://github.com/getgrav/grav/tree/1.7.40) (Commit [685d762](https://github.com/getgrav/grav/commit/685d76231a057416651ed192a6a2e83720800e61)) (Latest version as of writing) |\n| **Tested Versions**     | v1.7.40                                       |\n| **Internal Identifier** | STAR-2023-0008                                |\n| **CVE Identifier**      | TBD                                           |\n| **CWE(s)**              | CWE-184: Incomplete List of Disallowed Inputs, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine |\n\n## CVSS3.1 Scoring System:  \n**Base Score:** 7.2 (High)  \n**Vector String:** `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`  \n| **Metric**                   | **Value** |\n| ---------------------------- | --------- |\n| **Attack Vector (AV)**       | Network   |\n| **Attack Complexity (AC)**   | Low       |\n| **Privileges Required (PR)** | High      |\n| **User Interaction (UI)**    | None      |\n| **Scope (S)**                | Unchanged |\n| **Confidentiality \\(C)**     | High      |\n| **Integrity (I)**            | High      |\n| **Availability (A)**         | High      |\n\n## Product Overview:  \nGrav is a PHP-based flat-file content management system (CMS) designed to provide a fast and simple way to build websites. It supports rendering of web pages written in Markdown and Twig expressions, and provides an administration panel to manage the entire website via an optional Admin plugin.\n\n## Vulnerability Summary:  \nThe patch for [CVE-2022-2073](https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/), a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig\u0027s Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution.\n\n## Vulnerability Details:  \nTwig comes with an extension known as the [Core Extension](https://github.com/twigphp/Twig/blob/v1.44.7/src/Extension/CoreExtension.php) that is enabled by default when initialising a new [Twig environment](https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148). Twig\u0027s Core Extension provides multiple built-in filters, such as the `filter()` function, which can be used in Twig templates. \n\n[CVE-2022-2073](https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/) leverages the default `filter()` filter function in Twig to invoke arbitrary unsafe functions. This was patched by overriding the default `filter()` filter function in commit [9d6a2d](https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83) of Grav v1.7.34 to perform validation checks on the arguments passed to `filter()`:\n~~~diff php\n...\nclass GravExtension extends AbstractExtension implements GlobalsInterface\n{\n    ...\n    public function getFilters(): array\n    {\n        return [\n            ...\n            // Security fix\n+           new TwigFilter(\u0027filter\u0027, [$this, \u0027filterFilter\u0027], [\u0027needs_environment\u0027 =\u003e true]),\n        ];\n    }\n    \n    ...\n\n+   /**\n+    * @param Environment $env\n+    * @param array $array\n+    * @param callable|string $arrow\n+    * @return array|CallbackFilterIterator\n+    * @throws RuntimeError\n+    */\n+   function filterFilter(Environment $env, $array, $arrow)\n+   {\n+       if (is_string($arrow) \u0026\u0026 Utils::isDangerousFunction($arrow)) {\n+           throw new RuntimeError(\u0027Twig |filter(\"\u0027 . $arrow . \u0027\") is not allowed.\u0027);\n+       }\n+\n+       return \\twig_array_filter($env, $array, $arrow);\n+   }\n}\n~~~\n\nHowever, looking at the source code of [/src/Extension/CoreExtension.php](https://github.com/twigphp/Twig/blob/v1.44.7/src/Extension/CoreExtension.php) of Twig, alternative default Twig filters could also be used invoke arbitrary functions:\n~~~php\n...\nclass CoreExtension extends AbstractExtension\n{\n    ...\n    public function getFilters(): array\n    {\n        return [\n            ...\n            // array helpers\n            ...\n            new TwigFilter(\u0027filter\u0027, \u0027twig_array_filter\u0027, [\u0027needs_environment\u0027 =\u003e true]), // unsafe\n            new TwigFilter(\u0027map\u0027, \u0027twig_array_map\u0027, [\u0027needs_environment\u0027 =\u003e true]), // unsafe\n            new TwigFilter(\u0027reduce\u0027, \u0027twig_array_reduce\u0027, [\u0027needs_environment\u0027 =\u003e true]), // unsafe\n        ];\n    }\n~~~\n\nThe three filter functions above respectively call `array_filter()`, `array_map()` and `array_reduce()`. Since only `filter()` is being overriden by Grav to ensure that the callable passed to `filter()` does not result in the invocation of an unsafe function, the other two functions (i.e. `map()` and `reduce()`) could be used by an authenticated attacker that is able to inject and render malicious templates to gain remote code execution.\n\n## Exploit Conditions:    \nThis vulnerability can be exploited if the attacker has access to:\n1. an administrator account, or\n2. a non-administrator, user account that are granted the following permissions:\n    - login access to Grav admin panel, and\n    - page creation or update rights\n\n## Reproduction Steps:  \n1. Log in to Grav Admin using an administrator account.\n2. Navigate to `Accounts \u003e Add`, and ensure that the following permissions are assigned when creating a new low-privileged user:\n    * Login to Admin - Allowed\n    * Page Update - Allowed\n2. Log out of Grav Admin, and log back in using the account created in step 2.\n3. Navigate to `http://\u003cgrav_installation\u003e/admin/pages/home`.\n4. Click the `Advanced` tab and select the checkbox beside `Twig` to ensure that Twig processing is enabled for the modified webpage.\n5. Under the `Content` tab, insert the following payload within the editor:\n   ~~~twig\n   {{ [\u0027id\u0027] | map(\u0027system\u0027) }}\n   {{ [\u0027id\u0027] | reduce(\u0027system\u0027) }}\n   ~~~\n4. Click the Preview button. Observe that the output of the `id` shell command is returned in the preview.\n\n## Suggested Mitigations:  \nOverride the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.\n\nFor example:\n~~~diff\n...\nclass GravExtension extends AbstractExtension implements GlobalsInterface\n{\n    ...\n    public function getFilters(): array\n    {\n        return [\n            ...\n            // Security fix\n            new TwigFilter(\u0027filter\u0027, [$this, \u0027filterFilter\u0027], [\u0027needs_environment\u0027 =\u003e true]),\n+           new TwigFilter(\u0027map\u0027, [$this, \u0027mapFilter\u0027], [\u0027needs_environment\u0027 =\u003e true]),\n+           new TwigFilter(\u0027reduce\u0027, [$this, \u0027reduceFilter\u0027], [\u0027needs_environment\u0027 =\u003e true]),\n        ];\n    }\n\n    ...\n+   /**\n+    * @param Environment $env\n+    * @param array $array\n+    * @param callable|string $arrow\n+    * @return array|CallbackFilterIterator\n+    * @throws RuntimeError\n+    */\n+   function mapFilter(Environment $env, $array, $arrow)\n+   {\n+       if (!$arrow instanceof Closure \u0026\u0026 !is_string($arrow) || Utils::isDangerousFunction($arrow)) {\n+           throw new RuntimeError(\u0027Twig |map(\"\u0027 . $arrow . \u0027\") is not allowed.\u0027);\n+       }\n+\n+       return \\twig_array_map($env, $array, $arrow);\n+   }\n+ \n+   /**\n+    * @param Environment $env\n+    * @param array $array\n+    * @param callable|string $arrow\n+    * @return array|CallbackFilterIterator\n+    * @throws RuntimeError\n+    */\n+   function reduceFilter(Environment $env, $array, $arrow)\n+   {\n+       if (!$arrow instanceof Closure \u0026\u0026 !is_string($arrow) || Utils::isDangerousFunction($arrow)) {\n+           throw new RuntimeError(\u0027Twig |reduce(\"\u0027 . $arrow . \u0027\") is not allowed.\u0027);\n+       }\n+\n+       return \\twig_array_reduce($env, $array, $arrow);\n+   }\n}\n~~~\n\n## Detection Guidance:  \nThe following strategies may be used to detect potential exploitation attempts.\n1. Searching within Markdown pages using the following shell command:  \n   `grep -Priz -e \u0027\\|\\s*(map|reduce)\\s*\\(\u0027 /path/to/webroot/user/pages/`\n2. Searching within Doctrine cache data using the following shell command:  \n   `grep -Priz -e \u0027\\|\\s*(map|reduce)\\s*\\(\u0027  --include \u0027*.doctrinecache.data\u0027 /path/to/webroot/cache/`\n3. Searching within Twig cache using the following shell command:  \n   `grep -Priz -e \u0027twig_array_(map|reduce)\u0027 /path/to/webroot/cache/twig/`\n4. Searching within compiled Twig template files using the following shell command:  \n   `grep -Priz -e \u0027\\|\\s*(map|reduce)\\s*\\(\u0027 /path/to/webroot/cache/compiled/files/`\n\nNote that it is not possible to detect indicators of compromise reliably using the Grav log file (located at `/path/to/webroot/logs/grav.log` by default), as successful exploitation attempts do not generate any additional logs. However, it is worthwhile to examine any PHP errors or warnings logged to determine the existence of any failed exploitation attempts.\n\n## Credits:  \nNgo Wei Lin ([@Creastery](https://twitter.com/Creastery)) \u0026 Wang Hengyue ([@w_hy_04](https://twitter.com/w_hy_04)) of STAR Labs SG Pte. Ltd. ([@starlabs_sg](https://twitter.com/starlabs_sg))\n\n## Vulnerability Disclosure:  \nThis vulnerability report is subject to a 120 day disclosure deadline as per [STAR Labs SG Pte. Ltd.\u0027s Vulnerability Disclosure Policy](https://starlabs.sg/advisories/STAR%20Labs%20SG%20Pte.%20Ltd.%20Vulnerability%20Disclosure%20Policy.pdf). After 120 days have elapsed, the vulnerability report will be published to the public by [STAR Labs SG Pte. Ltd.](https://starlabs.sg/) (STAR Labs).  \n\nThe scheduled disclosure date is _**25th July, 2023**_. Disclosure at an earlier date is also possible if agreed upon by all parties.  \n\nKindly note that STAR Labs reserved and assigned the following CVE identifiers to the respective vulnerabilities presented in this report:  \n1. **CVE-2023-30596**\n    Server-side Template Injection (SSTI) in getgrav/grav \u003c= v1.7.40 allows Grav Admin users with page creation or update rights to bypass the dangerous functions denylist check in `GravExtension.filterFilter()` and to achieve remote code execution via Twig\u0027s default filters `map()` and `reduce()`. This is a bypass of CVE-2022-2073.\n",
  "id": "GHSA-whr7-m3f8-mpm8",
  "modified": "2023-06-16T19:37:08Z",
  "published": "2023-06-16T19:37:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66"
    },
    {
      "type": "WEB",
      "url": "https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav Server-side Template Injection (SSTI) via Twig Default Filters"
}

GHSA-WJ7R-P6PM-XX2R

Vulnerability from github – Published: 2024-06-17 15:30 – Updated: 2024-08-01 15:31
VLAI
Details

StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-37621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-97"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-17T14:15:11Z",
    "severity": "HIGH"
  },
  "details": "StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.",
  "id": "GHSA-wj7r-p6pm-xx2r",
  "modified": "2024-08-01T15:31:49Z",
  "published": "2024-06-17T15:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37621"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Hebing123/cve/issues/47"
    },
    {
      "type": "WEB",
      "url": "https://www.strongshop.cn"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WJV6-JCFJ-MF9R

Vulnerability from github – Published: 2026-07-28 21:50 – Updated: 2026-07-28 21:50
VLAI
Summary
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field
Details

Summary

datamodel-code-generator is vulnerable to code injection when a developer passes an --extra-template-data file whose comment value contains a literal \r (carriage return). The comment variable is rendered into a Python # comment in six built-in templates with no line-terminator escaping. Python's tokenizer treats a bare CR as a physical-line terminator (see Python language reference — Physical lines), so the comment ends at the \r and the text after it is parsed as Python, including, when the CR is followed by suitable indentation, as a statement within the class body that follows on the next template line.

Details

The vulnerable templates each contain # {{ comment }} with no escaping:

  • src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2:12 and :19
  • src/datamodel_code_generator/model/template/TypeAliasType.jinja2:12 and :19
  • src/datamodel_code_generator/model/template/TypeStatement.jinja2:12 and :19
  • src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2:4
  • src/datamodel_code_generator/model/template/pydantic_v2/RootModel.jinja2:19
  • src/datamodel_code_generator/model/template/pydantic_v2/RootModelTypeAlias.jinja2:13

The pydantic_v2/BaseModel.jinja2:4 site is representative:

class {{ class_name }}({{ base_class }}):{% if comment is defined %}  # {{ comment }}{% endif %}

When the developer-supplied extras file populates comment for a model, the value reaches the template via DataModel.extra_template_data (set in src/datamodel_code_generator/model/base.py:736-742) and Jinja2 interpolates it raw. None of the templates use comment_safe, escape_docstring, or any other line-terminator filter.

PoC

Complete self contained POC is available at my secret gist: https://gist.github.com/thegr1ffyn/8ad6b8cb3cc2be9d3a0144aeb6896a3f

Impact

  • Who's affected: any developer or CI pipeline that runs datamodel-codegen --extra-template-data <file> where the extras file is influenced by attacker-controlled input. Realistic scenarios include:
  • Extras file generated from a third-party schema-annotation system.
  • Extras file vendored from an upstream repository.
  • Extras file produced by a script that merges multiple comment sources.
  • Build pipelines that template the extras file from environment variables, ticket descriptions, or commit metadata.
  • What it gains: arbitrary Python code execution in the importer's process at import time.
  • What it does NOT need: the schema itself can be entirely benign; only the extras file needs to contain the malicious comment.
  • What does block it: not passing --extra-template-data, or rejecting extras files whose comment values contain \r, \x0b, or \x0c before invocation.

Resolution

The fix normalizes comment values from built-in --extra-template-data before template rendering. Inline comments now convert CRLF, bare CR, vertical tab, and form feed into LF and prefix continuation lines with #, so attacker-controlled text stays inside the generated Python comment block.

Remediation

Upgrade to datamodel-code-generator 0.60.2 or later.

This issue affects datamodel-code-generator versions >= 0.14.1, <= 0.60.1 and is fixed in 0.60.2.

Submitted by: Hamza Haroon (thegr1ffyn)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.60.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "datamodel-code-generator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.14.1"
            },
            {
              "fixed": "0.60.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T21:50:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`datamodel-code-generator` is vulnerable to code injection when a developer passes an `--extra-template-data` file whose `comment` value contains a literal `\\r` (carriage return). The `comment` variable is rendered into a Python `#` comment in six built-in templates with **no** line-terminator escaping. Python\u0027s tokenizer treats a bare CR as a physical-line terminator (see [Python language reference \u2014 Physical lines](https://docs.python.org/3/reference/lexical_analysis.html#physical-lines)), so the comment ends at the `\\r` and the text after it is parsed as Python, including, when the CR is followed by suitable indentation, as a statement within the class body that follows on the next template line.\n\n### Details\n\nThe vulnerable templates each contain `# {{ comment }}` with no escaping:\n\n- `src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2:12` and `:19`\n- `src/datamodel_code_generator/model/template/TypeAliasType.jinja2:12` and `:19`\n- `src/datamodel_code_generator/model/template/TypeStatement.jinja2:12` and `:19`\n- `src/datamodel_code_generator/model/template/pydantic_v2/BaseModel.jinja2:4`\n- `src/datamodel_code_generator/model/template/pydantic_v2/RootModel.jinja2:19`\n- `src/datamodel_code_generator/model/template/pydantic_v2/RootModelTypeAlias.jinja2:13`\n\nThe `pydantic_v2/BaseModel.jinja2:4` site is representative:\n\n```jinja2\nclass {{ class_name }}({{ base_class }}):{% if comment is defined %}  # {{ comment }}{% endif %}\n```\n\nWhen the developer-supplied extras file populates `comment` for a model, the value reaches the template via `DataModel.extra_template_data` (set in `src/datamodel_code_generator/model/base.py:736-742`) and Jinja2 interpolates it raw. None of the templates use `comment_safe`, `escape_docstring`, or any other line-terminator filter.\n\n### PoC\nComplete self contained POC is available at my secret gist: https://gist.github.com/thegr1ffyn/8ad6b8cb3cc2be9d3a0144aeb6896a3f\n\n### Impact\n\n- **Who\u0027s affected**: any developer or CI pipeline that runs `datamodel-codegen --extra-template-data \u003cfile\u003e` where the extras file is influenced by attacker-controlled input. Realistic scenarios include:\n  - Extras file generated from a third-party schema-annotation system.\n  - Extras file vendored from an upstream repository.\n  - Extras file produced by a script that merges multiple `comment` sources.\n  - Build pipelines that template the extras file from environment variables, ticket descriptions, or commit metadata.\n- **What it gains**: arbitrary Python code execution in the importer\u0027s process at `import` time.\n- **What it does NOT need**: the schema itself can be entirely benign; only the extras file needs to contain the malicious `comment`.\n- **What does block it**: not passing `--extra-template-data`, or rejecting extras files whose `comment` values contain `\\r`, `\\x0b`, or `\\x0c` before invocation.\n\n### Resolution\n\nThe fix normalizes `comment` values from built-in `--extra-template-data` before template rendering. Inline comments now convert CRLF, bare CR, vertical tab, and form feed into LF and prefix continuation lines with `# `, so attacker-controlled text stays inside the generated Python comment block.\n\n### Remediation\n\nUpgrade to `datamodel-code-generator` `0.60.2` or later.\n\nThis issue affects `datamodel-code-generator` versions `\u003e= 0.14.1, \u003c= 0.60.1` and is fixed in `0.60.2`.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-wjv6-jcfj-mf9r",
  "modified": "2026-07-28T21:50:09Z",
  "published": "2026-07-28T21:50:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/commit/b73abb5cd703a50471b8950bbd3bd0b82ad71de7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/koxudaxi/datamodel-code-generator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field"
}

GHSA-WJW6-95H5-4JPX

Vulnerability from github – Published: 2025-06-10 20:17 – Updated: 2026-06-08 20:18
VLAI
Summary
Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating
Details

Impact

What kind of vulnerability is it? Who is impacted?

All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.

Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:

  1. A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.
  2. A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.

Patches

Has the problem been patched? What versions should users upgrade to?

Nautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:

  • extras.add_secret
  • extras.change_secret
  • extras.view_secret
  • extras.add_computedfield
  • extras.change_computedfield
  • extras.add_customlink
  • extras.change_customlink
  • extras.add_jobbutton
  • extras.change_jobbutton

References

Are there any links users can visit to find out more?

  • https://jinja.palletsprojects.com/en/stable/sandbox/
  • https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description
  • https://github.com/nautobot/nautobot/pull/7417
  • https://github.com/nautobot/nautobot/pull/7429
Severity
6.0 (Medium)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nautobot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.4.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-10T20:17:15Z",
    "nvd_published_at": "2025-06-10T16:15:42Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAll users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected.\n\nDue to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot:\n\n1. A malicious user could configure this feature set in ways that could expose the value of Secrets defined in Nautobot when the templated content is rendered.\n2. A malicious user could configure this feature set in ways that could call Python APIs to modify data within Nautobot when the templated content is rendered, bypassing the object permissions assigned to the viewing user.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nNautobot versions 1.6.32 and 2.4.10 will include fixes for the vulnerability.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe vulnerability can be partially mitigated by configuring object permissions appropriately to limit the below actions to only trusted users:\n\n- `extras.add_secret`\n- `extras.change_secret`\n- `extras.view_secret`\n- `extras.add_computedfield`\n- `extras.change_computedfield`\n- `extras.add_customlink`\n- `extras.change_customlink`\n- `extras.add_jobbutton`\n- `extras.change_jobbutton`\n\n### References\n_Are there any links users can visit to find out more?_\n\n- https://jinja.palletsprojects.com/en/stable/sandbox/\n- https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description\n- https://github.com/nautobot/nautobot/pull/7417\n- https://github.com/nautobot/nautobot/pull/7429",
  "id": "GHSA-wjw6-95h5-4jpx",
  "modified": "2026-06-08T20:18:22Z",
  "published": "2025-06-10T20:17:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wjw6-95h5-4jpx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49142"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/7417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nautobot/nautobot/pull/7429"
    },
    {
      "type": "WEB",
      "url": "https://docs.djangoproject.com/en/4.2/ref/templates/api/#alters-data-description"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nautobot/nautobot"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2025-74.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2025-79.yaml"
    },
    {
      "type": "WEB",
      "url": "https://jinja.palletsprojects.com/en/stable/sandbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating"
}

GHSA-WQC2-GWGP-9P7W

Vulnerability from github – Published: 2024-09-27 18:32 – Updated: 2024-09-27 21:31
VLAI
Details

A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-46366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-27T17:15:13Z",
    "severity": "HIGH"
  },
  "details": "A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system.",
  "id": "GHSA-wqc2-gwgp-9p7w",
  "modified": "2024-09-27T21:31:50Z",
  "published": "2024-09-27T18:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46366"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WRPQ-J7Q3-24J7

Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32
VLAI
Details

Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-66613"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T13:17:50Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated Remote Code Execution (RCE) in JetEngine \u003c= 3.8.14 versions.",
  "id": "GHSA-wrpq-j7q3-24j7",
  "modified": "2026-08-19T15:32:23Z",
  "published": "2026-08-19T15:32:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66613"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-14-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X238-V9F9-93G8

Vulnerability from github – Published: 2025-04-28 15:31 – Updated: 2025-04-28 15:31
VLAI
Details

Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.

Severity
2.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-23376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-28T15:15:45Z",
    "severity": "LOW"
  },
  "details": "Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.",
  "id": "GHSA-x238-v9f9-93g8",
  "modified": "2025-04-28T15:31:41Z",
  "published": "2025-04-28T15:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23376"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000311083/dsa-2025-062-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-X658-H3PQ-CHCG

Vulnerability from github – Published: 2026-10-06 12:30 – Updated: 2026-10-06 12:30
VLAI
Details

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.

Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().

This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.

The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-105985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T11:17:16Z",
    "severity": "HIGH"
  },
  "details": "Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action\u00a0app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an\u00a0EntryType\u00a0object\u2019s\u00a0uiLabelFormat\u00a0and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by\u00a0renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as\u00a0system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.",
  "id": "GHSA-x658-h3pq-chcg",
  "modified": "2026-10-06T12:30:32Z",
  "published": "2026-10-06T12:30:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105985"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.11.0"
    },
    {
      "type": "WEB",
      "url": "https://www.hckrt.com/hacktivity/HCKRT-PVWH7W"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-X67C-8PWR-M8G3

Vulnerability from github – Published: 2026-09-03 22:49 – Updated: 2026-09-03 22:49
VLAI
Summary
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel
Details

CVE: This vulnerability corresponds to CVE-2026-72807.

Summary

Attribute-view (AV) template columns are live-evaluated on every render and expose the queryBlocks template function, which runs raw SQL on the read-write database handle (SelectBlocksRawStmt, using ?→argument string substitution rather than parameter binding). AV mutations are admin-gated, so this is not directly reader-injectable but it is a second-order vector: an attacker distributes a SiYuan document or AV package whose template column contains .action{queryBlocks "<arbitrary SQL>"} when a victim imports the package and renders the AV, the attacker's SQL executes on the victim's kernel (read and, via statement stacking, write).

Details

Doc-level {{…}} templates are rendered at insert-time and become static, so they are not re-evaluated on reader view. The residual is AV template columns, which are live-evaluated at render. queryBlocks passes its argument to SelectBlocksRawStmt with ?→arg string substitution, not a bound parameter, on the main read-write handle (88250/go-sqlite3 fork, statement-stacking capable) so an attacker-controlled template argument becomes arbitrary SQL.

The SSTI surface is otherwise hardened: BuiltInTemplateFuncs deletes env, expandenv, and getHostByName so there is no environment/host/file/exec SSTI. queryBlocks-to-SQL is the remaining live-evaluated sink.

Proof of Concept

An AV template column set to .action{queryBlocks "<sql>"} executes <sql> against the read-write handle when the AV is rendered. Delivered second-order: a shared/imported document or AV package carrying such a column runs the embedded SQL on any kernel that imports and renders it.

Proof of Concept

Reproduced on a live instance.

1. Host doc + AV (admin, 6806):

POST /api/filetree/createDocWithMd {notebook, path:"/ssti-poc", markdown:"host"}  → DOC
POST /api/av/renderAttributeView   {id:"<AV>"}   # materializes the AV

2. Plant the malicious template column (one performTransactions call):

{"reqId":1,"session":"poc","transactions":[{"doOperations":[
  {"action":"addAttrViewCol","avID":"<AV>","id":"<COL>","name":"tpl","type":"template"},
  {"action":"updateAttrViewColTemplate","avID":"<AV>","id":"<COL>","type":"template",
   "data":".action{range queryBlocks \"SELECT * FROM blocks WHERE root_id='<PROTECTED_DOC_ID>'\"}.action{.Markdown} .action{end}"},
  {"action":"insertAttrViewBlock","avID":"<AV>","isDetached":true}
]}]}

3. Trigger (render evaluates the template):

POST /api/av/renderAttributeView {id:"<AV>"}

Result: the template cell renders ## LockedSection TOP_SECRET… the queryBlocks SQL executed and returned the password-protected document's content, arbitrary SQL via template reading across the publish/password boundary. queryBlocks uses ?→arg string substitution (not parameterized), so UNION and stacked writes are also possible. Delivered second-order, the same column executes on any kernel that imports and renders the AV.

Impact

An attacker who gets a victim to import a crafted document/AV package and render it achieves arbitrary SQL execution on the victim's kernel cross-notebook read and via stacking, write. Precondition is content delivery plus render (import of an attacker-supplied package), which bounds severity to Medium. Not directly reachable by an anonymous reader (AV creation is admin-gated); the injection travels in stored/imported template content.

Suggested fix

Parameterize queryBlocks bind the argument rather than substituting it into the SQL string or restrict the template function set available in AV columns as was done for the doc-template functions. Treat imported template content as untrusted at render time.

Severity
8.0 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260723035036-0a176345e02a"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72807"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T22:49:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**CVE:** This vulnerability corresponds to [CVE-2026-72807](https://nvd.nist.gov/vuln/detail/CVE-2026-72807).\n\n### Summary\n\nAttribute-view (AV) template columns are live-evaluated on every render and expose the `queryBlocks` template function, which runs raw SQL on the read-write database handle (`SelectBlocksRawStmt`, using `?`\u2192argument string substitution rather than parameter binding). AV mutations are admin-gated, so this is not directly reader-injectable but it is a second-order vector: an attacker distributes a SiYuan document or AV package whose template column contains `.action{queryBlocks \"\u003carbitrary SQL\u003e\"}` when a victim imports the package and renders the AV, the attacker\u0027s SQL executes on the victim\u0027s kernel (read and, via statement stacking, write).\n\n### Details\n\nDoc-level `{{\u2026}}` templates are rendered at insert-time and become static, so they are not re-evaluated on reader view. The residual is AV template columns, which are live-evaluated at render. `queryBlocks` passes its argument to `SelectBlocksRawStmt` with `?`\u2192arg string substitution, not a bound parameter, on the main read-write handle (`88250/go-sqlite3` fork, statement-stacking capable) so an attacker-controlled template argument becomes arbitrary SQL.\n\nThe SSTI surface is otherwise hardened: `BuiltInTemplateFuncs` deletes `env`, `expandenv`, and `getHostByName` so there is no environment/host/file/exec SSTI. `queryBlocks`-to-SQL is the remaining live-evaluated sink.\n\n### Proof of Concept\n\nAn AV template column set to `.action{queryBlocks \"\u003csql\u003e\"}` executes `\u003csql\u003e` against the read-write handle when the AV is rendered. Delivered second-order: a shared/imported document or AV package carrying such a column runs the embedded SQL on any kernel that imports and renders it.\n\n### Proof of Concept\n\nReproduced on a live instance.\n\n**1. Host doc + AV (admin, 6806):**\n```\nPOST /api/filetree/createDocWithMd {notebook, path:\"/ssti-poc\", markdown:\"host\"}  \u2192 DOC\nPOST /api/av/renderAttributeView   {id:\"\u003cAV\u003e\"}   # materializes the AV\n```\n\n**2. Plant the malicious template column (one performTransactions call):**\n```json\n{\"reqId\":1,\"session\":\"poc\",\"transactions\":[{\"doOperations\":[\n  {\"action\":\"addAttrViewCol\",\"avID\":\"\u003cAV\u003e\",\"id\":\"\u003cCOL\u003e\",\"name\":\"tpl\",\"type\":\"template\"},\n  {\"action\":\"updateAttrViewColTemplate\",\"avID\":\"\u003cAV\u003e\",\"id\":\"\u003cCOL\u003e\",\"type\":\"template\",\n   \"data\":\".action{range queryBlocks \\\"SELECT * FROM blocks WHERE root_id=\u0027\u003cPROTECTED_DOC_ID\u003e\u0027\\\"}.action{.Markdown} .action{end}\"},\n  {\"action\":\"insertAttrViewBlock\",\"avID\":\"\u003cAV\u003e\",\"isDetached\":true}\n]}]}\n```\n\n**3. Trigger (render evaluates the template):**\n```\nPOST /api/av/renderAttributeView {id:\"\u003cAV\u003e\"}\n```\nResult: the template cell renders `## LockedSection TOP_SECRET\u2026` the `queryBlocks` SQL executed and returned the password-protected document\u0027s content, arbitrary SQL via template reading across the publish/password boundary. `queryBlocks` uses `?`\u2192arg string substitution (not parameterized), so UNION and stacked writes are also possible. Delivered second-order, the same column executes on any kernel that imports and renders the AV.\n\n### Impact\n\nAn attacker who gets a victim to import a crafted document/AV package and render it achieves arbitrary SQL execution on the victim\u0027s kernel cross-notebook read and via stacking, write. Precondition is content delivery plus render (import of an attacker-supplied package), which bounds severity to Medium. Not directly reachable by an anonymous reader (AV creation is admin-gated); the injection travels in stored/imported template content.\n\n### Suggested fix\n\nParameterize `queryBlocks` bind the argument rather than substituting it into the SQL string or restrict the template function set available in AV columns as was done for the doc-template functions. Treat imported template content as untrusted at render time.",
  "id": "GHSA-x67c-8pwr-m8g3",
  "modified": "2026-09-03T22:49:31Z",
  "published": "2026-09-03T22:49:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72807"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/0a176345e02a0d19bdc7762e50e0b92002087d20"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel"
}

GHSA-X7GR-MMJJ-HX3H

Vulnerability from github – Published: 2024-11-14 18:30 – Updated: 2026-04-01 18:32
VLAI
Details

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.15.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-52393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-82",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-14T18:15:26Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.15.",
  "id": "GHSA-x7gr-mmjj-hx3h",
  "modified": "2026-04-01T18:32:24Z",
  "published": "2024-11-14T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52393"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/podlove-podcasting-plugin-for-wordpress/vulnerability/wordpress-podlove-podcast-publisher-plugin-4-1-15-admin-remote-code-execution-rce-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/podlove-podcasting-plugin-for-wordpress/wordpress-podlove-podcast-publisher-plugin-4-1-15-admin-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

Mitigation
Implementation

Use the template engine's sandbox or restricted mode, if available.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list