CVE-2026-34172

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34172", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T20:12:04.198Z", "datePublished": "2026-03-31T13:50:17.240Z", "dateUpdated": "2026-03-31T19:09:13.342Z"}, "containers": {"cna": {"title": "Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m"}], "affected": [{"vendor": "Giskard-AI", "product": "giskard-oss", "versions": [{"version": "< 0.3.4", "status": "affected"}, {"version": ">= 1.0.1a1, < 1.0.2b1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T13:50:17.240Z"}, "descriptions": [{"lang": "en", "value": "Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1."}], "source": {"advisory": "GHSA-frv4-x25r-588m", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T18:39:22.718455Z", "id": "CVE-2026-34172", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T19:09:13.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34172", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T18:39:22.718455Z"}}}], "references": [{"url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T19:05:21.971Z"}}], "cna": {"title": "Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment", "source": {"advisory": "GHSA-frv4-x25r-588m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Giskard-AI", "product": "giskard-oss", "versions": [{"status": "affected", "version": "< 0.3.4"}, {"status": "affected", "version": ">= 1.0.1a1, < 1.0.2b1"}]}], "references": [{"url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m", "name": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T13:50:17.240Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34172", "state": "PUBLISHED", "dateUpdated": "2026-03-31T19:09:13.342Z", "dateReserved": "2026-03-25T20:12:04.198Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T13:50:17.240Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "giskard-oss", "vendor": "Giskard-AI", "versions": [{"status": "affected", "version": "< 0.3.4"}, {"status": "affected", "version": ">= 1.0.1a1, < 1.0.2b1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:giskard:giskard-agent:*:*:*:*:*:python:*:*", "matchCriteriaId": "694950AE-BE3D-4FBA-BB9C-8DCC461CFD12", "versionEndExcluding": "0.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:giskard:giskard-agent:1.0.2:alpha1:*:*:*:python:*:*", "matchCriteriaId": "9251F71D-20D7-47D4-A694-6C8ECF15A562", "vulnerable": true}, {"criteria": "cpe:2.3:a:giskard:giskard-agents:1.0.1:alpha1:*:*:*:python:*:*", "matchCriteriaId": "2582855A-A2CD-4E65-95BE-AB008A15A902", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1."}, {"lang": "es", "value": "Giskard es una biblioteca Python de c\u00f3digo abierto para probar y evaluar sistemas ag\u00e9nticos. Antes de las versiones 0.3.4 y 1.0.2b1, ChatWorkflow.chat(message) pasa su argumento de cadena directamente como una fuente de plantilla Jinja2 a un entorno no aislado. Un desarrollador que pasa la entrada del usuario a este m\u00e9todo habilita la ejecuci\u00f3n remota de c\u00f3digo completa a trav\u00e9s del recorrido de clases de Jinja2. El nombre del m\u00e9todo chat y el nombre del par\u00e1metro message invitan naturalmente a pasar la entrada del usuario directamente, pero la cadena se analiza silenciosamente como una plantilla Jinja2, no se trata como texto sin formato. Este problema ha sido parcheado en las versiones 0.3.4 y 1.0.2b1."}], "id": "CVE-2026-34172", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34172", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T18:39:22.718455Z", "version": "2.0.3"}}]}, "published": "2026-03-31T15:16:17.507", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.1a1,1.0.2b1)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "giskard-oss", "source": "cna", "vendor": "Giskard-AI"}, "product": "giskard", "vendor": "giskard-ai"}], "analysis": {"en": {"generated_at": "2026-04-08T00:00:43.572999+00:00", "value": {"mitigation_remediation": ["Upgrade Giskard OSS to version 0.3.4 or later, or 1.0.2b1 or later, where the patch removes the vulnerable template handling."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects the Giskard\u2011AI open\u2011source library, Giskard OSS, specifically the giskard-agent package. Versions prior to 0.3.4 and 1.0.2b1 are vulnerable, as identified by the provided CPE entries. The vulnerability is present in the ChatWorkflow.chat() method of the library\u2019s agent component.", "description_and_impact": "Giskard Agents contain a server\u2011side template injection flaw. The ChatWorkflow.chat() method accepts a message string and passes it directly to a Jinja2 Environment without sandboxing. Because the template engine is not sandboxed, an attacker who supplies crafted input can perform class traversal and execute arbitrary code on the system where the agent runs. The vulnerability is classified as CWE\u20111336, a remote code execution weakness.", "risk_and_exploitability": "The CVSS score is 7.7, indicating high severity, while the EPSS score is below 1\u202f% and the vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack path requires an attacker to supply input to the chat() method, which can occur when untrusted data is processed through the library. Although broad exploitation is believed to be limited by the low EPSS, the potential impact of remote code execution is catastrophic; therefore, the overall risk is considered high and mitigation should be pursued urgently. Detailed exploitation steps are not provided in the description, so mitigation focuses on eliminating the risk vector rather than fixing it programmatically."}}}}, "created": "2026-03-31T19:54:38.823545+00:00", "updated": "2026-04-08T20:00:23.238909+00:00", "vendors": ["giskard-ai", "giskard-ai$PRODUCT$giskard"]}