PT-2024-29658 · Haystack+1 · Haystack+1

Silvanocerza · Published 2024-07-31 · Updated 2024-08-01 · CVE-2024-41950

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Haystack versions prior to 2.3.1

Description The issue concerns Haystack clients that allow users to create and run Pipelines from scratch, making them vulnerable to remote code executions. Certain components in Haystack utilize Jinja2 templates. If an individual can create and render these templates on the client machine, they can execute any code.

Recommendations For versions prior to 2.3.1, update to Haystack version 2.3.1 to resolve the issue. As a temporary workaround, consider preventing users from running the affected components or only letting users use preselected templates.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2024-41950

GHSA-HX9V-6R9F-W677

Affected Products

Haystack

Jinja2

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41950.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-41950 · Security Note
• https://osv.dev/vulnerability/GHSA-hx9v-6r9f-w677 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41950 · Vendor Advisory
• https://github.com/deepset-ai/haystack · Note
• https://github.com/deepset-ai/haystack/security/advisories/GHSA-hx9v-6r9f-w677 · Note
• https://github.com/deepset-ai/haystack/commit/3fed1366c448b02189851bf08166c1f6477a02b0 · Note
• https://github.com/deepset-ai/haystack/pull/8096 · Note
• https://github.com/deepset-ai/haystack/releases/tag/v2.3.1 · Note
• https://github.com/deepset-ai/haystack/pull/8095 · Note
• https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e · Note
• https://t.me/cvedetector/2149 · Telegram Post
• https://t.me/cvenotify/88088 · Telegram Post
• https://t.me/cvenotify/88206 · Telegram Post