GHSA-5f29-2333-h9c7
Critical · 9.1CVSS
9.1
EPSS
—
Published
Jan 7, 2026
CISA due date
—
The record
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.open-metadata:platform | 0 | 1.11.4 |
Related vulnerabilities
- CVE-2026-22244 OpenMetadata is a unified metadata platform. Same vulnerability
- CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
- CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
- CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
- CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
- CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336