Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. The vulnerability has been fixed with Haystack `2.3.1`.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| deepset-ai | haystack | before 2.3.1 | 2.3.1 | Patch available | CNA |
| — | haystack-ai (PyPI) | before 2.3.1 | 2.3.1 | Patch available | GHSA-hx9v-6r9f-w677 |
- haystack Vendordeepset-ai Affected before 2.3.1 Fixed in 2.3.1 Patch available CNA
- haystack-ai (PyPI) Vendor— Affected before 2.3.1 Fixed in 2.3.1 Patch available GHSA-hx9v-6r9f-w677
Remediation
- Fix · CNA haystack (deepset-ai) Fixed in 2.3.1
- Fix · GHSA-hx9v-6r9f-w677 haystack-ai (PyPI) Fixed in 2.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41950
- 2026-10-03 Alias added: GHSA-hx9v-6r9f-w677
References
Other 7
- https://github.com/deepset-ai/haystack/security/advisories/GHSA-hx9v-6r9f-w677
- https://github.com/deepset-ai/haystack/pull/8095
- https://github.com/deepset-ai/haystack/pull/8096
- https://github.com/deepset-ai/haystack/commit/3fed1366c448b02189851bf08166c1f6477a02b0
- https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e
- https://github.com/deepset-ai/haystack/releases/tag/v2.3.1
- https://github.com/deepset-ai/haystack
More deepset-ai vulnerabilities
- TI-2026-83742 Path traversal in deepset-ai farm tokenizer loader CVSS 4.0MEDIUM 5.3
- TI-2026-83743 Path traversal in deepset-ai farm Model Package Loader CVSS 4.0LOW 2.4
Sources
- CVE-2024-41950 · CVE Program
- CVE-2024-41950 · NVD
- FIRST EPSS
- GHSA-hx9v-6r9f-w677 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences