CVE-2025-25362: Spacy-LLM SSTI RCE Vulnerability

CVE-2025-25362 Overview

A Server-Side Template Injection (SSTI) vulnerability has been identified in Spacy-LLM v0.7.2, a popular library that integrates Large Language Models (LLMs) into spaCy NLP pipelines. This vulnerability allows attackers to execute arbitrary code by injecting a crafted payload into the template field, potentially leading to complete system compromise.

Critical Impact

Attackers can achieve remote code execution on systems running vulnerable versions of Spacy-LLM by exploiting the template injection vulnerability, potentially gaining full control over the affected server.

Affected Products

• Spacy-LLM v0.7.2
• Applications using Spacy-LLM with user-controllable template inputs
• NLP pipelines integrating vulnerable Spacy-LLM versions

Discovery Timeline

• 2025-03-05 - CVE-2025-25362 published to NVD
• 2025-04-02 - Last updated in NVD database

Technical Details for CVE-2025-25362

Vulnerability Analysis

This Server-Side Template Injection vulnerability exists in the template processing functionality of Spacy-LLM. The library uses a templating engine to construct prompts for LLM interactions, but fails to properly sanitize user-supplied input before processing it through the template engine. This allows attackers to inject malicious template directives that are evaluated server-side, leading to arbitrary code execution.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), which encompasses scenarios where user-controlled input is incorporated into dynamically generated code without proper validation. In the context of SSTI, the template engine interprets injected payloads as legitimate template expressions rather than treating them as plain text data.

Root Cause

The root cause of this vulnerability lies in the insufficient input validation and sanitization of the template field in Spacy-LLM. When user-supplied data is passed to the templating engine without proper escaping or sandboxing, the engine processes malicious template syntax as executable code. This is a common pattern in SSTI vulnerabilities where the boundary between data and code is not properly enforced in template processing pipelines.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by submitting specially crafted input to the template field of an application using Spacy-LLM. The malicious payload leverages the template engine's expression evaluation capabilities to access underlying Python objects and execute arbitrary commands on the server.

Typical SSTI exploitation in Python environments involves traversing the object hierarchy to reach dangerous functions like os.system() or subprocess.Popen(). The attacker crafts template expressions that navigate from basic objects to these powerful system-level functions, ultimately achieving code execution.

For detailed technical analysis and proof-of-concept information, refer to the Hacktive Security Blog CVE Analysis and the GitHub Issue Discussion.

Detection Methods for CVE-2025-25362

Indicators of Compromise

• Unusual template syntax patterns in application logs containing characters like {{, }}, {%, or %}
• Unexpected process spawning from Python/Spacy-LLM application processes
• Suspicious outbound network connections originating from NLP pipeline services
• Log entries showing access to Python magic methods or internal objects like __class__, __mro__, or __subclasses__

Detection Strategies

• Implement input validation rules to detect and block common SSTI payloads in template fields
• Monitor application logs for template syntax injection attempts and unusual expression patterns
• Deploy web application firewalls (WAF) with rules specifically targeting template injection payloads
• Use runtime application self-protection (RASP) to detect code execution attempts within template processing

Monitoring Recommendations

• Enable verbose logging for Spacy-LLM template processing operations
• Set up alerts for anomalous command execution patterns from Python processes
• Monitor file system access patterns for unauthorized reads or writes from application contexts
• Implement network segmentation and monitor for unexpected egress traffic from LLM pipeline servers

How to Mitigate CVE-2025-25362

Immediate Actions Required

• Audit all applications using Spacy-LLM v0.7.2 to identify exposed template input vectors
• Implement strict input validation to sanitize template field inputs before processing
• Restrict network access to affected systems and apply principle of least privilege
• Review the GitHub Issue Discussion for vendor guidance and patch availability

Patch Information

Monitor the official Spacy-LLM repository for security patches addressing this vulnerability. Check the GitHub Issue Discussion for updates from the maintainers regarding fixes and recommended upgrade paths. Upgrade to a patched version as soon as one becomes available.

Workarounds

• Avoid passing user-controlled input directly to template fields without strict sanitization
• Implement a whitelist approach for allowed template content and reject any input containing template syntax characters
• Consider sandboxing the template processing environment to limit the impact of successful exploitation
• Use parameterized templates where user input is strictly separated from template logic

# Configuration example - Input validation for template fields
# Add to your application's input processing layer

# Example: Block common SSTI patterns in input
# Reject inputs containing: {{ }} {% %} __ (double underscore)
# Implement at application layer before passing to Spacy-LLM

# Network isolation for affected services
# Restrict outbound connections from LLM pipeline servers
iptables -A OUTPUT -m owner --uid-owner spacy-user -j DROP