CVE-2026-2969
📋 TL;DR
This CVE describes a Server-Side Template Injection (SSTI) vulnerability in datapizza-ai's Jinja2 template handler. Attackers can inject malicious templates through the ChatPromptTemplate function, potentially leading to remote code execution. All systems running datapizza-ai version 0.0.2 with the vulnerable component are affected.
💻 Affected Systems
- datapizza-labs datapizza-ai
📦 What is this software?
Datapizza Ai by Datapizza
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution allowing complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized access to sensitive data, system information disclosure, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing denial of service.
🎯 Exploit Status
Proof of concept available in GitHub repository. Remote exploitation confirmed possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider removing or replacing the vulnerable component.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation for ChatPromptTemplate arguments to prevent template injection
# Add input validation in prompt.py before processing templates
# Example: validate and sanitize user input before passing to Jinja2
Jinja2 Sandbox Configuration
allConfigure Jinja2 with sandboxed environment to limit template execution capabilities
from jinja2.sandbox import SandboxedEnvironment
env = SandboxedEnvironment()
🧯 If You Can't Patch
- Network segmentation: Isolate systems running datapizza-ai from critical infrastructure
- Implement WAF rules to detect and block SSTI patterns in HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check if datapizza-ai version 0.0.2 is installed and if ChatPromptTemplate function is used with user-controlled inputCheck Version:
pip show datapizza-ai | grep VersionVerify Fix Applied:
Test with known SSTI payloads to confirm they are properly sanitized or blocked📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Suspicious Jinja2 template patterns in logs
- Unexpected system commands in application logs
Network Indicators:
- HTTP requests containing Jinja2 template syntax
- Unusual outbound connections from datapizza-ai process
SIEM Query:
source="datapizza-ai" AND ("{{.*}}" OR "{% .* %}" OR "{# .* #}")