CVE-2026-2969

Katalog CVE

CVSS 7.2 · High EPSS 0,81%

Kerentanan Incomplete Filtering of Special Elements pada datapizza ai. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Affected is the function ChatPromptTemplate of the file datapizza-ai-core/datapizza/modules/prompt/prompt.py of the component Jinja2 Template Handler. This manipulation of the argument Prompt causes improper neutralization of special elements used in a template engine. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

23 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-791: Incomplete Filtering of Special Elements
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hacktivesec/datapizza-ai-disclosure/blob/main/ssti.md exploit · advisory pihak ketiga
• https://github.com/hacktivesec/datapizza-ai-disclosure/blob/main/ssti.md#poc exploit · advisory pihak ketiga
• https://vuldb.com/?id.347336 advisory pihak ketiga
• https://vuldb.com/?ctiid.347336 exploit · permissions required
• https://vuldb.com/?submit.755357 exploit