CVE-2026-2969 - Vulnerability Analysis

Overview

datapizza-labs datapizza-ai 0.0.2 contains a template injection caused by improper neutralization of special elements in ChatPromptTemplate of Jinja2 Template Handler, letting remote attackers execute arbitrary template code, exploit requires crafted input.

Severity & Score

Impact

Remote attackers can execute arbitrary template code, potentially leading to remote code execution or data compromise.

Mitigation

Update to the latest version when available.

References

• https://github.com/hacktivesec/datapizza-ai-disclosure/blob/main/ssti.md
• https://github.com/hacktivesec/datapizza-ai-disclosure/blob/main/ssti.md#poc
• https://vuldb.com/?ctiid.347336
• https://vuldb.com/?id.347336
• https://vuldb.com/?submit.755357

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner