GHSA-frv4-x25r-588m: Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Summary

giskard-agents versions up to 0.3.3 and the 1.0.x alpha line pass the string argument of ChatWorkflow.chat() directly into an unsandboxed Jinja2 Environment, so user input is parsed as a template. A developer who passes user input to this method exposes the server to remote code execution through Jinja2 class traversal, which can run system commands, read files and access environment variables.

Mitigation

Update to 0.3.4 (or 1.0.2b1 for the pre-release branch), which replaces the unsandboxed Jinja2 Environment with SandboxedEnvironment.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• giskard-agentsPyPILLM dependency since 2025-11-04 · 3 tracked dependents

Related items

• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database