{"data":{"id":"db5b7ca6-0269-4452-9cfb-ff186507cc05","title":"GHSA-frv4-x25r-588m: Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment","summary":"giskard-agents versions up to 0.3.3 and the 1.0.x alpha line pass the string argument of ChatWorkflow.chat() directly into an unsandboxed Jinja2 Environment, so user input is parsed as a template. A developer who passes user input to this method exposes the server to remote code execution through Jinja2 class traversal, which can run system commands, read files and access environment variables.","solution":"Update to 0.3.4 (or 1.0.2b1 for the pre-release branch), which replaces the unsandboxed Jinja2 Environment with SandboxedEnvironment.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-frv4-x25r-588m","publishedAt":"2026-03-27T22:17:30.000Z","cveId":"CVE-2026-34172","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["giskard-agents@>= 1.0.1a1, <= 1.0.2a1 (fixed: 1.0.2b1)","giskard-agents@<= 0.3.3 (fixed: 0.3.4)"],"affectedPackageNames":["giskard-agents"],"affectedPackageRefs":["pypi:giskard-agents"],"affectedVendors":[],"affectedVendorsRaw":["Giskard Agents","giskard-agents"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00635,"epssCheckedAt":"2026-11-09T06:13:51.691Z","kevDateAdded":null,"advisoryAliases":["GHSA-frv4-x25r-588m"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-27T22:17:30.000Z","fixReleasedAt":"2026-03-25T12:48:33.687Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:39:20.071Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"giskard-agents","fixedVersion":"0.3.4","matchedVersion":"0.3.4","fixReleasedAt":"2026-03-25T12:48:33.687Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:19.925Z"},{"ecosystem":"pypi","name":"giskard-agents","fixedVersion":"1.0.2b1","matchedVersion":"1.0.2b1","fixReleasedAt":"2026-03-26T11:07:51.977Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:19.925Z"}]}}