High, CVSS 7.7PyPIAmendedPublished
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
CVE-2026-34172 · GHSA-frv4-x25r-588m
- Affected
- PyPI giskard-agents <= 0.3.3; >= 1.0.1a1, <= 1.0.2a1
- Fixed in
- 0.3.41.0.2b1· Vendor fix available
- Issue
- ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. Root Cause libs/giskard-agents/src/giskard/agents/workflow.py line ~261: The string becomes contenttemplate, which is parsed by fromstring(): libs/giskard-agents/src/giskard/agents/templates/message.py lines 14-15: The Jinja2 Environment is not sandboxed: libs/giskard-agents/src/giskard/agents/templates/environment.py line 37: Proof of Concept A developer building a chatbot: Note: using .withinputs(var=userdata) is safe because variable values are not parsed as templates. The issue is only when user strings are passed directly to chat(). Impact Remote code execution on…
Recommended action: Upgrade to 1.0.2b1 (pre-release) or 0.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.