Description (CNA)
A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PySpur-Dev / pyspur | affected 0.1.0; affected 0.1.1; affected 0.1.2; affected 0.1.3; affected 0.1.4; affected 0.1.5; affected 0.1.6; affected 0.1.7; affected 0.1.8; affected 0.1.9; affected 0.1.10; affected 0.1.11; affected 0.1.12; affected 0.1.13; affected 0.1.14; affected 0.1.15; affected 0.1.16; affected 0.1.17; affected 0.1.18 |
CWE
CWE-1336, CWE-791
References
- https://vuldb.com/?id.313638
- https://vuldb.com/?ctiid.313638
- https://vuldb.com/?submit.593612
- https://github.com/PySpur-Dev/pyspur/issues/289
ADP enrichment
No English description supplied.
No references supplied.