Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

haystack-ai

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7PyPIAmendedPublished

    Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

    CVE-2024-41950 · GHSA-hx9v-6r9f-w677

    Affected
    • PyPI haystack-ai < 2.3.1
    Fixed in
    2.3.1· Vendor fix available
    Issue
    Impact Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. Patches The problem has been fixed with PRs deepset-ai/haystack#8095 and deepset-ai/haystack#8096. Both have been released with Haystack 2.3.1. Workarounds Prevent users from running the affected Components, or only let users use preselected templates. References The list of impacted Components can be found in the release notes for 2.3.1. https://github.com/deepset-ai/haystack/releases/tag/v2.3.1

    Recommended action: Upgrade to 2.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →