GHSA-q5xx-fxv3-xxqf
Medium · 4.7CVSS
4.7
EPSS
—
Published
Feb 23, 2026
CISA due date
—
The record
datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | datapizza-ai-core | 0 | No fix |
Related vulnerabilities
- CVE-2026-2969 A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Same vulnerability
- GHSA-hg58-x52p-859c datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache Also affects datapizza-ai-core
- CVE-2026-2970 A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2. Also affects datapizza-ai-core
- CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
- CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
- CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336