CVE-2021-44657

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

2.47% chance of exploitation in the next 30 days, 83th percentile

Published

2021-12-15

Updated

2024-08-04

Proof-of-concept exploits (2)

• pallets/jinja/issues/549
• https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templat…

References

• CVE Record
• NVD entry

Related

• CVE-2021-44655
• CVE-2021-44659
• CVE-2021-44653
• CVE-2021-4466
• CVE-2021-4465
• CVE-2021-44663