Read the docs
TI-2021-08020 Aliases CVE-2021-26068GHSA-vrw4-6wc8-c6x6

Injection in Atlassian Jira Server for Slack

Priority MEDIUM 44CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template injection vulnerability.

Why it matters now

EPSS 0.0301 87th percentileScored 2026-11-07
Fix Fixed Jira Server for Slack (Atlassian): 2.0.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianJira Server for Slack0.0.3 and later; before 2.0.152.0.15Patch availableCNA
  • Jira Server for Slack VendorAtlassian Affected 0.0.3 and later; before 2.0.15 Fixed in 2.0.15 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:jira_server_for_slack:*:*:*:*:*:*:*:*0.0.3 to before 2.0.15VulnerableAtlassian
  • cpe:2.3:a:atlassian:jira_server_for_slack:*:*:*:*:*:*:*:* Versions 0.0.3 to before 2.0.15 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Jira Server for Slack (Atlassian) Fixed in 2.0.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-26068
  2. 2026-10-03 Alias added: GHSA-vrw4-6wc8-c6x6

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences