Common Weakness Enumeration
CWE-1336
AllowedImproper Neutralization of Special Elements Used in a Template Engine
Abstraction: Base · Status: Incomplete
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
361 vulnerabilities reference this CWE, most recent first.
CVE-2026-73505 (GCVE-0-2026-73505)
Vulnerability from cvelistv5 – Published: 2026-08-13 14:21 – Updated: 2026-08-13 15:18
VLAI
EPSS
VEX
Title
Oh My Posh: Arbitrary command execution via template injection in the path segment
Summary
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:18 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/JanDeDobbeleer/oh-my-posh/secu… | x_refsource_CONFIRM |
| https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711 | x_refsource_MISC |
| https://github.com/JanDeDobbeleer/oh-my-posh/comm… | x_refsource_MISC |
| https://github.com/JanDeDobbeleer/oh-my-posh/rele… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| JanDeDobbeleer | oh-my-posh |
Affected:
< 29.35.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73505",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:18:06.808055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:18:34.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "oh-my-posh",
"vendor": "JanDeDobbeleer",
"versions": [
{
"status": "affected",
"version": "\u003c 29.35.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:21:57.231Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"
},
{
"name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"
},
{
"name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690"
},
{
"name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
}
],
"source": {
"advisory": "GHSA-6xj8-qv9j-xcjq",
"discovery": "UNKNOWN"
},
"title": "Oh My Posh: Arbitrary command execution via template injection in the path segment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73505",
"datePublished": "2026-08-13T14:21:57.231Z",
"dateReserved": "2026-08-12T19:00:33.736Z",
"dateUpdated": "2026-08-13T15:18:34.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73330 (GCVE-0-2026-73330)
Vulnerability from cvelistv5 – Published: 2026-08-12 19:00 – Updated: 2026-08-14 16:52
VLAI
EPSS
VEX
Title
CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action
Summary
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 19:46 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/owen2345/camaleon-cms | productpatch |
| https://enrik-m.github.io/posts/Camaleon-CMS-Vuln… | product |
| https://www.vulncheck.com/advisories/camaleoncms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| owen2345 | CamaleonCMS |
Affected:
0 , ≤ 2.9.1
(custom)
cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:* |
Date Public
2026-08-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T19:46:36.307436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:46:41.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "CamaleonCMS",
"vendor": "owen2345",
"versions": [
{
"lessThanOrEqual": "2.9.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Amir Aliu \u0026 Enrik Mustafa"
}
],
"datePublic": "2026-08-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:52:27.408Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Product Repository",
"tags": [
"product",
"patch"
],
"url": "https://github.com/owen2345/camaleon-cms"
},
{
"name": "Blog Post",
"tags": [
"product"
],
"url": "https://enrik-m.github.io/posts/Camaleon-CMS-Vulnerabilties/#44-stored-xss-via-draft-post-title"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/camaleoncms-server-side-template-injection-via-test-email-action"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73330",
"datePublished": "2026-08-12T19:00:36.609Z",
"dateReserved": "2026-08-11T21:47:14.059Z",
"dateUpdated": "2026-08-14T16:52:27.408Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73299 (GCVE-0-2026-73299)
Vulnerability from cvelistv5 – Published: 2026-08-12 17:31 – Updated: 2026-08-12 18:54
VLAI
EPSS
VEX
Title
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Summary
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 18:53 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/microsoft/prompty/security/adv… | x_refsource_CONFIRM |
| https://github.com/microsoft/prompty/pull/404 | x_refsource_MISC |
| https://github.com/microsoft/prompty/pull/405 | x_refsource_MISC |
| https://github.com/microsoft/prompty/commit/e4a0e… | x_refsource_MISC |
| https://github.com/microsoft/prompty/commit/f5c57… | x_refsource_MISC |
| https://github.com/microsoft/prompty/tree/typescr… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73299",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T18:53:50.277151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:54:20.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prompty",
"vendor": "microsoft",
"versions": [
{
"status": "affected",
"version": "\u003c 0.1.5"
},
{
"status": "affected",
"version": "\u003e= 2.0.0-alpha.1, \u003c 2.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T17:31:38.807Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6"
},
{
"name": "https://github.com/microsoft/prompty/pull/404",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/prompty/pull/404"
},
{
"name": "https://github.com/microsoft/prompty/pull/405",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/prompty/pull/405"
},
{
"name": "https://github.com/microsoft/prompty/commit/e4a0ebf49e3a78d5d7796c8480bf9a4f0c54d19e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/prompty/commit/e4a0ebf49e3a78d5d7796c8480bf9a4f0c54d19e"
},
{
"name": "https://github.com/microsoft/prompty/commit/f5c57c94a0990cca79d095c3daab661b4b1fb89f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/prompty/commit/f5c57c94a0990cca79d095c3daab661b4b1fb89f"
},
{
"name": "https://github.com/microsoft/prompty/tree/typescript/2.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoft/prompty/tree/typescript/2.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-w28w-gp39-m4p6",
"discovery": "UNKNOWN"
},
"title": "Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73299",
"datePublished": "2026-08-12T17:31:38.807Z",
"dateReserved": "2026-08-11T19:42:11.450Z",
"dateUpdated": "2026-08-12T18:54:20.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72911 (GCVE-0-2026-72911)
Vulnerability from cvelistv5 – Published: 2026-08-10 21:00 – Updated: 2026-08-13 15:51
VLAI
EPSS
VEX
Title
ERPNext: Possibility of server-side template injection due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:51 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/56458 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/5f6952b1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/88443e4a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/ecb6d48e… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.29.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:51:21.859979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:51:32.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.118.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.29.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:00:46.536Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7"
},
{
"name": "https://github.com/frappe/erpnext/pull/56458",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/56458"
},
{
"name": "https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28"
},
{
"name": "https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39"
},
{
"name": "https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.118.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.118.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.29.0"
}
],
"source": {
"advisory": "GHSA-qq49-v74j-hjh7",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Possibility of server-side template injection due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72911",
"datePublished": "2026-08-10T21:00:46.536Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-13T15:51:32.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72827 (GCVE-0-2026-72827)
Vulnerability from cvelistv5 – Published: 2026-08-14 11:35 – Updated: 2026-08-14 14:41
VLAI
EPSS
VEX
Title
Grav CMS before 2.0.13 Remote Code Execution via Twig
Summary
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:41 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/grav-cms-bef… | third-party-advisory |
Impacted products
Date Public
2026-07-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72827",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:41:34.508067Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:41:54.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav",
"vendor": "getgrav",
"versions": [
{
"lessThan": "2.0.13",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.0.13",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Kuba0123"
}
],
"datePublic": "2026-07-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T11:35:35.138Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xx48-97m4-h7qm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-xx48-97m4-h7qm"
},
{
"name": "VulnCheck Advisory: Grav CMS before 2.0.13 Remote Code Execution via Twig",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-twig"
}
],
"title": "Grav CMS before 2.0.13 Remote Code Execution via Twig",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72827",
"datePublished": "2026-08-14T11:35:35.138Z",
"dateReserved": "2026-08-10T15:12:59.509Z",
"dateUpdated": "2026-08-14T14:41:54.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71502 (GCVE-0-2026-71502)
Vulnerability from cvelistv5 – Published: 2026-08-06 20:30 – Updated: 2026-08-08 21:05
VLAI
EPSS
VEX
Title
Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute
Summary
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.
An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application's configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.
Vue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application's nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.
The malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:
* Access data available to the victim through the application.
* Extract API keys, tokens, or other sensitive information exposed to the page.
* Perform authenticated actions using the victim's session.
* Modify conversions or other application data.
* Escalate the impact by targeting an administrator.
A demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.
The patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 13:57 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| misp | cti-transmute |
Affected:
0 , ≤ 1.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T13:57:26.854958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T13:57:37.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cti-transmute",
"repo": "https://github.com/MISP/cti-transmute",
"vendor": "misp",
"versions": [
{
"lessThanOrEqual": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Christian Studer"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.\u003c/p\u003e\u003cp\u003eAn unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application\u0027s configured \u003ccode\u003e[[ ... ]]\u003c/code\u003e delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.\u003c/p\u003e\u003cp\u003eVue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript \u003ccode\u003eFunction\u003c/code\u003e constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application\u0027s nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the \u003ccode\u003eunsafe-eval\u003c/code\u003e policy exception.\u003c/p\u003e\u003cp\u003eThe malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:\u003c/p\u003e\u003cul\u003e\u003cli\u003eAccess data available to the victim through the application.\u003c/li\u003e\u003cli\u003eExtract API keys, tokens, or other sensitive information exposed to the page.\u003c/li\u003e\u003cli\u003ePerform authenticated actions using the victim\u0027s session.\u003c/li\u003e\u003cli\u003eModify conversions or other application data.\u003c/li\u003e\u003cli\u003eEscalate the impact by targeting an administrator.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eA demonstrated payload can use \u003ccode\u003e[].constructor.constructor(...)\u003c/code\u003e to obtain the JavaScript \u003ccode\u003eFunction\u003c/code\u003e constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.\u003c/p\u003e\u003cp\u003eThe patch addresses the vulnerability by registering a global Jinja \u003ccode\u003efinalize\u003c/code\u003e hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data.\n\nAn unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue expression using the application\u0027s configured [[ ... ]] delimiters. User profile names may provide an additional injection vector. Although Jinja HTML escaping is applied, the resulting value is subsequently included in a DOM region compiled by Vue.\n\nVue interprets the attacker-controlled value as a template expression rather than ordinary text. By accessing the JavaScript Function constructor from within the expression, an attacker can execute arbitrary JavaScript in the security context of the CTI-Transmute origin. The application\u0027s nonce-based Content Security Policy does not prevent exploitation because the Vue runtime compiler requires the unsafe-eval policy exception.\n\nThe malicious payload is stored by the application and executed whenever another user opens an affected page, such as the public conversion detail page. The victim may be a normal user or an administrator. Successful exploitation could allow the attacker to:\n\n * Access data available to the victim through the application.\n * Extract API keys, tokens, or other sensitive information exposed to the page.\n * Perform authenticated actions using the victim\u0027s session.\n * Modify conversions or other application data.\n * Escalate the impact by targeting an administrator.\n\n\nA demonstrated payload can use [].constructor.constructor(...) to obtain the JavaScript Function constructor and execute arbitrary code. The regression tests also show that a short first-stage payload could retrieve an uncapped conversion description and evaluate a larger second-stage payload.\n\nThe patch addresses the vulnerability by registering a global Jinja finalize hook that inserts a zero-width Unicode word joiner inside every Vue delimiter found in server-rendered values. This prevents Vue from recognizing the values as template expressions while preserving their visible representation."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T21:05:36.527Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/ecfdaef63860a071c6f07afd30156ca77a77ad2b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/522fa8ff8223b12a6128ea3fc2344a77b7b9108d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/ad8bf2b8031491cefb552314ef7ff6f4148ca95a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/4f43c9181a00262bec2a6dfbc9ff9c50d534e918"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-71502",
"datePublished": "2026-08-06T20:30:04.442Z",
"dateReserved": "2026-08-06T20:29:59.894Z",
"dateUpdated": "2026-08-08T21:05:36.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71291 (GCVE-0-2026-71291)
Vulnerability from cvelistv5 – Published: 2026-08-05 12:38 – Updated: 2026-08-10 11:47
VLAI
EPSS
VEX
Title
Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering
Summary
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 15:46 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bolt/core | third-party-advisory |
| https://github.com/bolt/core/blob/6.1/src/Entity/… | third-party-advisory |
Date Public
2026-08-05 12:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T15:46:43.858659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:47:35.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "core",
"programFiles": [
"src/Entity/Field.php",
"config/bolt/contenttypes.yaml"
],
"vendor": "bolt",
"versions": [
{
"lessThanOrEqual": "6.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Saidakbarxon Maxsudxonov"
}
],
"datePublic": "2026-08-05T12:38:41.070Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBolt CMS renders content field values through Twig\u0027s full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition\u0027s allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.\u003c/p\u003e"
}
],
"value": "Bolt CMS renders content field values through Twig\u0027s full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition\u0027s allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:47:24.089Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/bolt/core"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/bolt/core/blob/6.1/src/Entity/Field.php"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71291",
"datePublished": "2026-08-05T12:38:41.070Z",
"dateReserved": "2026-08-05T12:37:57.357Z",
"dateUpdated": "2026-08-10T11:47:24.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71286 (GCVE-0-2026-71286)
Vulnerability from cvelistv5 – Published: 2026-08-05 12:26 – Updated: 2026-08-10 11:47
VLAI
EPSS
VEX
Title
ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString
Summary
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 15:45 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/miguelcobain/ember-dynamic-ren… | third-party-advisory |
| https://github.com/miguelcobain/ember-dynamic-ren… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miguelcobain | ember-dynamic-render-template |
Affected:
0 , ≤ 0.0.6
(semver)
|
Date Public
2026-08-05 12:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T15:45:31.383242Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:45:49.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ember-dynamic-render-template",
"programFiles": [
"addon/components/render-template.js"
],
"vendor": "miguelcobain",
"versions": [
{
"lessThanOrEqual": "0.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bekzod Tursunov"
}
],
"datePublic": "2026-08-05T12:26:31.793Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer\u0027s compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.\u003c/p\u003e"
}
],
"value": "The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer\u0027s compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:47:14.855Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/miguelcobain/ember-dynamic-render-template"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71286",
"datePublished": "2026-08-05T12:26:31.793Z",
"dateReserved": "2026-08-05T12:23:34.968Z",
"dateUpdated": "2026-08-10T11:47:14.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71239 (GCVE-0-2026-71239)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45
VLAI
EPSS
VEX
Title
DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
Summary
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 12:56 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/DjangoCRM/django-crm | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DjangoCRM | django-crm |
Affected:
0
|
Date Public
2026-08-05 10:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T12:56:04.729854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:56:18.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "django-crm",
"programFiles": [
"massmail/views/message_previews.py",
"massmail/utils/email_creators.py",
"massmail/utils/helpers.py"
],
"vendor": "DjangoCRM",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mirdavlatov Mira\u0027zam"
}
],
"datePublic": "2026-08-05T10:56:36.819Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDjangoCRM\u0027s massmail module renders user-controlled EmlMessage fields (subject, content) through Django\u0027s Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.\u003c/p\u003e"
}
],
"value": "DjangoCRM\u0027s massmail module renders user-controlled EmlMessage fields (subject, content) through Django\u0027s Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:45:44.417Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/DjangoCRM/django-crm"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71239",
"datePublished": "2026-08-05T10:56:36.819Z",
"dateReserved": "2026-08-05T10:53:53.175Z",
"dateUpdated": "2026-08-10T11:45:44.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69118 (GCVE-0-2026-69118)
Vulnerability from cvelistv5 – Published: 2026-08-10 19:42 – Updated: 2026-08-11 17:51 X_Open Source
VLAI
EPSS
VEX
Title
Cachet 2.4.1 Authenticated Server-Side Template Injection RCE
Summary
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:44 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/cachethq/cachet/issues/4621 | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/cachet-authe… | third-party-advisory |
Date Public
2026-07-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:44:32.837506Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:51:59.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageURL": "pkg:composer/cachethq/cachet",
"product": "cachet",
"repo": "https://github.com/cachethq/cachet",
"vendor": "cachethq",
"versions": [
{
"lessThanOrEqual": "2.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T19:42:32.749Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/cachethq/cachet/issues/4621"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cachet-authenticated-server-side-template-injection-rce"
}
],
"tags": [
"x_open-source"
],
"title": "Cachet 2.4.1 Authenticated Server-Side Template Injection RCE",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-69118",
"datePublished": "2026-08-10T19:42:32.749Z",
"dateReserved": "2026-08-03T13:26:21.234Z",
"dateUpdated": "2026-08-11T17:51:59.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
Mitigation
Implementation
Use the template engine's sandbox or restricted mode, if available.
No CAPEC attack patterns related to this CWE.