PT-2026-21491 · Datapizza · Datapizza-Ai

Edoardottt · Publicado 2026-02-22 · Atualizado 2026-02-23 · CVE-2026-2969

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions datapizza-labs datapizza-ai version 0.0.2

Description A flaw exists in the Jinja2 Template Handler component of datapizza-ai. Specifically, the ChatPromptTemplate function within the datapizza-ai-core/datapizza/modules/prompt/prompt.py file is susceptible to improper neutralization of special elements used in a template engine due to manipulation of the Prompt argument. This allows for remote exploitation. The exploit has been published. The vendor was contacted but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-791

CWE-1336

Identificadores relacionados

CVE-2026-2969

GHSA-Q5XX-FXV3-XXQF

Produtos afetados

Datapizza-Ai

Referências · 14

• 🔥 https://github.com/hacktivesec/datapizza-ai-disclosure/blob/main/ssti.md · Exploit
• 🔥 https://vuldb.com/?ctiid.347336 · Exploit
• 🔥 https://vuldb.com/?submit.755357 · Exploit
• 🔥 https://github.com/hacktivesec/datapizza-ai-disclosure/blob/main/ssti.md#poc · Exploit
• https://github.com/datapizza-labs/datapizza-ai · Nota
• https://t.me/CVEtracker/45470 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2969 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2025644218610303000 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2969 · Nota de Segurança
• https://vuldb.com/?id.347336 · Nota
• https://twitter.com/VulmonFeeds/status/2025646778658213986 · Publicação no Twitter
• https://t.me/cveNotify/152810 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2025809024567108052 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-q5xx-fxv3-xxqf · Aviso do Fabricante