CVE-2026-31864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31864", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T19:02:25.013Z", "datePublished": "2026-03-13T19:22:05.168Z", "dateUpdated": "2026-03-13T19:44:51.850Z"}, "containers": {"cna": {"title": "JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc"}, {"name": "https://github.com/jumpserver/jumpserver/pull/16608", "tags": ["x_refsource_MISC"], "url": "https://github.com/jumpserver/jumpserver/pull/16608"}], "affected": [{"vendor": "jumpserver", "product": "jumpserver", "versions": [{"version": "< 3.10.22", "status": "affected"}, {"version": ">= 4.0.0, < 4.10.16", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:22:05.168Z"}, "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks."}], "source": {"advisory": "GHSA-qx8h-rx2j-j5wc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:44:43.290795Z", "id": "CVE-2026-31864", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:44:51.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T19:44:43.290795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:44:48.625Z"}}], "cna": {"title": "JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering", "source": {"advisory": "GHSA-qx8h-rx2j-j5wc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jumpserver", "product": "jumpserver", "versions": [{"status": "affected", "version": "< 3.10.22"}, {"status": "affected", "version": ">= 4.0.0, < 4.10.16"}]}], "references": [{"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc", "name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jumpserver/jumpserver/pull/16608", "name": "https://github.com/jumpserver/jumpserver/pull/16608", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:22:05.168Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31864", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:44:51.850Z", "dateReserved": "2026-03-09T19:02:25.013Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T19:22:05.168Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jumpserver", "vendor": "jumpserver", "versions": [{"status": "affected", "version": "< 3.10.22"}, {"status": "affected", "version": ">= 4.0.0, < 4.10.16"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD655DF8-C263-4EC3-91F9-BB374C2C7ACD", "versionEndExcluding": "3.10.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DA50E29-0D69-476A-A92C-2D48FF5E51B0", "versionEndExcluding": "4.10.16", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks."}, {"lang": "es", "value": "JumpServer es un host basti\u00f3n de c\u00f3digo abierto y un sistema de auditor\u00eda de seguridad de operaci\u00f3n y mantenimiento. Existe una vulnerabilidad de inyecci\u00f3n de plantillas del lado del servidor (SSTI) en la funcionalidad de carga de Applet y VirtualApp de JumpServer. Esta vulnerabilidad solo puede ser explotada por usuarios con privilegios administrativos (permisos de Gesti\u00f3n de Applets de Aplicaci\u00f3n o Gesti\u00f3n de Aplicaciones Virtuales). Los atacantes pueden explotar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario dentro del contenedor de JumpServer Core. La vulnerabilidad surge del uso inseguro del renderizado de plantillas Jinja2 al procesar archivos de configuraci\u00f3n YAML cargados por el usuario. Cuando un usuario carga un paquete ZIP de Applet o VirtualApp, el archivo manifest.yml se renderiza a trav\u00e9s de Jinja2 sin restricciones de sandbox, lo que permite ataques de inyecci\u00f3n de plantillas."}], "id": "CVE-2026-31864", "lastModified": "2026-06-17T10:34:39.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:44:43.290795Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:36.803", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/jumpserver/jumpserver/pull/16608"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.10.22)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.10.16)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jumpserver", "source": "cna", "vendor": "jumpserver"}, "product": "jumpserver", "vendor": "jumpserver"}], "analysis": {"en": {"generated_at": "2026-03-18T15:27:59.605766+00:00", "value": {"mitigation_remediation": ["Update JumpServer to the latest patched release that removes unsandboxed Jinja2 rendering of uploaded YAML.", "If an update is not immediately available, restrict administrative privileges so that only trusted users may upload Applet or VirtualApp packages.", "Monitor for failed upload attempts or anomalous Jinja2-like expressions in the audit logs.", "Verify that Jinja2 rendering has been sandboxed or disabled for uploaded content."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is JumpServer (identified by the CPE cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*). No specific affected version ranges are listed in the CVE data; therefore, all releases containing the vulnerable Applet/VirtualApp upload logic may be impacted.", "description_and_impact": "JumpServer, an open source bastion host, has a Server\u2011Side Template Injection vulnerability in its Applet and VirtualApp upload process. The flaw arises from unsandboxed Jinja2 template rendering of user\u2011supplied YAML manifests. Attackers with administrative privileges can inject Jinja2 expressions that are evaluated inside the core container, yielding arbitrary code execution on the host. This directly jeopardizes confidentiality, integrity, and availability of the JumpServer environment and any systems managed through it.", "risk_and_exploitability": "The CVSS score of 6.8 indicates a medium\u2011to\u2011high risk. The EPSS score of less than 1% suggests that exploitation is uncommon, and the vulnerability is not listed in the CISA KEV catalogue. However, because exploitation requires administrative access to upload privileged package manifests, the threat is limited to trusted accounts; if such access is compromised, an attacker can trivially execute arbitrary code within the core container, making the vulnerability a serious threat to privileged users."}}}}, "created": "2026-03-16T09:24:18.681475+00:00", "updated": "2026-03-23T13:40:14.010344+00:00", "vendors": ["jumpserver", "jumpserver$PRODUCT$jumpserver"]}