Read the docs
TI-2026-26471 Aliases CVE-2026-34172GHSA-frv4-x25r-588m

Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Priority HIGH 69CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00635 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed giskard-oss (Giskard-AI): 0.3.4, 1.0.2b1giskard-agents (PyPI): 0.3.4, 1.0.2b1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Giskard-AIgiskard-ossbefore 0.3.4; 1.0.1a1 to before 1.0.2b10.3.4, 1.0.2b1Patch availableCNA
—giskard-agents (PyPI)before 0.3.40.3.4Patch availableGHSA-frv4-x25r-588m
—giskard-agents (PyPI)1.0.1a1 to before 1.0.2b11.0.2b1Patch availableGHSA-frv4-x25r-588m
  • giskard-oss VendorGiskard-AI Affected before 0.3.4; 1.0.1a1 to before 1.0.2b1 Fixed in 0.3.4, 1.0.2b1 Patch available CNA
  • giskard-agents (PyPI) Vendor— Affected before 0.3.4 Fixed in 0.3.4 Patch available GHSA-frv4-x25r-588m
  • giskard-agents (PyPI) Vendor— Affected 1.0.1a1 to before 1.0.2b1 Fixed in 1.0.2b1 Patch available GHSA-frv4-x25r-588m

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:giskard:giskard-agent:*:*:*:*:*:python:*:*before 0.3.4VulnerableGiskard-AI
cpe:2.3:a:giskard:giskard-agent:1.0.2:alpha1:*:*:*:python:*:*1.0.2 alpha1VulnerableGiskard-AI
cpe:2.3:a:giskard:giskard-agents:1.0.1:alpha1:*:*:*:python:*:*1.0.1 alpha1VulnerableGiskard-AI
  • cpe:2.3:a:giskard:giskard-agent:*:*:*:*:*:python:*:* Versions before 0.3.4 Vulnerable ·Giskard-AI
  • cpe:2.3:a:giskard:giskard-agent:1.0.2:alpha1:*:*:*:python:*:* Versions 1.0.2 alpha1 Vulnerable ·Giskard-AI
  • cpe:2.3:a:giskard:giskard-agents:1.0.1:alpha1:*:*:*:python:*:* Versions 1.0.1 alpha1 Vulnerable ·Giskard-AI

Remediation

  • Fix · CNA giskard-oss (Giskard-AI) Fixed in 0.3.4, 1.0.2b1
  • Fix · GHSA-frv4-x25r-588m giskard-agents (PyPI) Fixed in 0.3.4 Advisory →
  • Fix · GHSA-frv4-x25r-588m giskard-agents (PyPI) Fixed in 1.0.2b1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34172
  2. 2026-10-03 Alias added: GHSA-frv4-x25r-588m
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-28 EPSS moved to the 50th–90th percentile

References

Exploit 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences