CVE-2026-27629: InvenTree Template Injection RCE Vulnerability

CVE-2026-27629 Overview

CVE-2026-27629 is a Server-Side Template Injection (SSTI) vulnerability affecting InvenTree, an Open Source Inventory Management System. The vulnerability exists in the customizable Jinja2 template functionality used for generating batch codes. A user with staff permissions can modify the server-side template to exfiltrate sensitive information or achieve code execution on the server.

Critical Impact

Staff users can exploit insecure Jinja2 template processing to expose sensitive server information or execute arbitrary code, with the ability for the malicious template to affect other users who generate batch codes.

Affected Products

• InvenTree versions prior to 1.2.3
• InvenTree versions between 1.2.3 and 1.3.0

Discovery Timeline

• 2026-02-25 - CVE-2026-27629 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27629

Vulnerability Analysis

This vulnerability stems from improper sandboxing of Jinja2 template execution in InvenTree's batch code generation feature. When generating custom batch codes, the application allows staff users to customize Jinja2 templates without adequate security controls. The insecure template processing enables attackers to craft malicious templates that can access server-side resources, read sensitive configuration data, or execute arbitrary code within the server context.

The attack requires initial access as a staff user to modify the batch code template. However, once the template has been modified maliciously, subsequent API calls to generate batch codes by other users will execute the malicious template code within their user context, potentially expanding the impact of the attack.

Root Cause

The root cause of this vulnerability is improper neutralization of special elements used in a template engine (CWE-1336). The InvenTree application failed to implement proper sandboxing for Jinja2 template execution, allowing server-side templates to be hijacked to access internal server resources and execute unauthorized code. The customizable STOCK_BATCH_CODE_TEMPLATE and PART_NAME_FORMAT global settings were not adequately restricted, enabling malicious template modification by staff users.

Attack Vector

The attack is conducted via adjacent network access with low complexity but requires low-level privileges (staff access) and user interaction. An attacker with staff permissions can modify the Jinja2 template used for batch code generation through the application's settings interface. The malicious template can then be triggered when any user makes an API request to generate a custom batch code.

The vulnerability allows for data exfiltration through template variables that expose server-side information, as well as potential code execution through Jinja2's template evaluation capabilities. The changed scope characteristic means the compromised component can affect resources beyond its security scope. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-27629

Indicators of Compromise

• Unusual modifications to STOCK_BATCH_CODE_TEMPLATE or PART_NAME_FORMAT global settings
• Unexpected Jinja2 template syntax in batch code configuration containing object attribute access or method calls
• Anomalous API requests to batch code generation endpoints with unusual response content
• Server logs showing template rendering errors or unexpected data access patterns

Detection Strategies

• Monitor audit logs for changes to global template settings by staff users
• Implement file integrity monitoring on template configuration files
• Review API access logs for unusual patterns in batch code generation requests
• Deploy application-level monitoring to detect template injection attempts

Monitoring Recommendations

• Enable detailed logging for all template configuration changes
• Set up alerts for modifications to sensitive global settings like STOCK_BATCH_CODE_TEMPLATE and PART_NAME_FORMAT
• Monitor server resource access patterns during template execution
• Implement rate limiting and anomaly detection on batch code generation API endpoints

How to Mitigate CVE-2026-27629

Immediate Actions Required

• Upgrade InvenTree to version 1.2.3 or 1.3.0 and later immediately
• Review and audit all staff user permissions and recent template modifications
• Override STOCK_BATCH_CODE_TEMPLATE and PART_NAME_FORMAT at the system level to prevent client-side editing
• Review server logs for any suspicious batch code generation activity

Patch Information

The InvenTree development team has addressed this vulnerability in version 1.2.3 and all versions from 1.3.0 onwards. The patch implements secure sandboxed execution for all template generation operations, preventing template injection attacks. Users should upgrade to the patched versions as soon as possible. Additional details are available in the GitHub Security Advisory.

Workarounds

• Override STOCK_BATCH_CODE_TEMPLATE at the system level to a safe default value to prevent client-side editing
• Override PART_NAME_FORMAT at the system level with a secure default configuration
• Restrict staff access privileges to only essential personnel until patching is complete
• Implement network segmentation to limit adjacent network access to the InvenTree server

# System-level configuration override example for InvenTree
# Add to your InvenTree configuration file to prevent template editing

# Override batch code template at system level
INVENTREE_STOCK_BATCH_CODE_TEMPLATE="{% now 'Y-m-d' %}-{{ ref }}"

# Override part name format at system level  
INVENTREE_PART_NAME_FORMAT="{{ name }}"

# These settings cannot be changed from the client side once the server is running