Template injection in Wizarr wizard steps enables code execution
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.
Summary
Wizarr before 2026.9.1 evaluates wizard step Markdown in an unsandboxed Jinja2 environment (CWE-1336). An authenticated user who can create wizard steps, or an administrator who imports an untrusted bundle, can run arbitrary Python when the stored step is rendered. This allows operating-system commands as the application user, disclosure of the Flask SECRET_KEY and connected service credentials, and stored cross-site scripting.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Wizarr to version 2026.9.1, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA wizarr (wizarrrr) Fixed in 2026.9.1
Timeline
- 2026-10-10 Threatist record created from CVE-2026-108264
- 2026-10-11 Priority changed: MEDIUM → LOW
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → HIGH
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences