Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

published 2026-03-27 7 mo ago modified 2026-07-24 3 mo ago also GHSA-frv4-x25r-588m , PYSEC-2026-2487 , EUVD-2026-17451

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1.

Patch / fix

fixed in 2

pypi giskard-agents 0.3.4, 1.0.2b1
giskard giskard-agent 0.3.4

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-03-31)

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.7	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.7	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	giskard-agents	<0.3.4 >=1.0.1a1, <1.0.2b1	0.3.4 1.0.2b1

Affected products

Giskard-AI giskard-oss

Classification

Weakness

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

References

github.com /Giskard-AI/giskard-oss/security/advisories/GHSA-frv4-x25r-588m
exploit, web, mitigation, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-34172
advisory
github.com /Giskard-AI/giskard-oss
package
pypi.org /project/giskard-agents
package
github.com /advisories/GHSA-frv4-x25r-588m
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary