Executive Summary

CVE-2026-2969 is a Server Side Template Injection (SSTI) vulnerability found in version 0.0.2 of the datapizza-labs datapizza-ai software. It affects the ChatPromptTemplate function in the datapizza-ai-core/datapizza/modules/prompt/prompt.py file, specifically in the Jinja2 Template Handler component.

The vulnerability arises because the application uses the Jinja2 template engine to compile and render user-controlled templates without proper sanitization or sandboxing. This improper neutralization of special elements in the template allows attackers to inject malicious Jinja2 expressions.

An attacker can exploit this flaw remotely by injecting crafted templates that execute arbitrary system commands on the server, such as creating files or listing directory contents, effectively allowing full server takeover.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including full compromise of the affected system. Attackers who control prompt templates can execute arbitrary system commands remotely, potentially gaining complete control over the server.

• Remote command execution on the server.
• Complete subversion of the application’s behavior.
• Potential reverse shell access and full server takeover.
• Compromise of confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for the presence of the vulnerable datapizza-ai version 0.0.2 and specifically the use of the ChatPromptTemplate function in the file datapizza-ai-core/datapizza/modules/prompt/prompt.py that uses Jinja2 templates without proper sanitization.'}, {'type': 'paragraph', 'content': "Detection can also involve looking for signs of Server Side Template Injection (SSTI) exploitation attempts, such as unusual template rendering behavior or unexpected files created by commands like 'touch pwned1' or 'touch pwned2' on the server."}, {'type': 'paragraph', 'content': "A practical approach is to attempt to inject Jinja2 expressions remotely (in a controlled and authorized environment) to see if arbitrary commands can be executed, for example by injecting payloads that execute commands like 'ls -alh' or create files."}, {'type': 'paragraph', 'content': "Specific commands to detect exploitation attempts or verify vulnerability include checking for the presence of suspicious files created by exploits (e.g., 'pwned1', 'pwned2') using:"}, {'type': 'list_item', 'content': 'ls -alh | grep pwned'}, {'type': 'list_item', 'content': "find / -name 'pwned*' 2>/dev/null"}, {'type': 'paragraph', 'content': 'Additionally, monitoring network traffic for unusual requests containing Jinja2 template syntax or payloads targeting the ChatPromptTemplate endpoint may help detect exploitation attempts.'}] [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include avoiding the use of the vulnerable datapizza-ai version 0.0.2 or replacing the affected component with an alternative product.'}, {'type': 'paragraph', 'content': "If continuing to use the affected software, modify the code to use Jinja2's sandboxed environment to safely render templates instead of directly using jinja2.Template with untrusted input."}, {'type': 'paragraph', 'content': 'Ensure that any user-controlled input used in template rendering is properly sanitized and neutralized to prevent injection of malicious template expressions.'}, {'type': 'paragraph', 'content': 'Since the vendor has not responded and no official patch is available, consider restricting access to the vulnerable functionality to trusted users only and monitor for exploitation attempts.'}] [2, 3]

Useful 0 Not Useful 0