CVE-2026-2969: Datapizza AI RCE Vulnerability

CVE-2026-2969 Overview

A Server-Side Template Injection (SSTI) vulnerability has been discovered in datapizza-labs datapizza-ai version 0.0.2. The flaw exists in the ChatPromptTemplate function within the file datapizza-ai-core/datapizza/modules/prompt/prompt.py, specifically in the Jinja2 Template Handler component. An attacker can manipulate the Prompt argument to achieve improper neutralization of special elements used in the template engine, potentially leading to remote code execution or information disclosure.

Critical Impact

Remote exploitation is possible through improper neutralization of special template elements. The exploit has been publicly disclosed and the vendor has not responded to disclosure attempts.

Affected Products

• datapizza datapizza_ai version 0.0.2
• Datapizza AI applications using the vulnerable Jinja2 Template Handler component
• Systems utilizing the ChatPromptTemplate function with user-controlled input

Discovery Timeline

• 2026-02-23 - CVE CVE-2026-2969 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-2969

Vulnerability Analysis

This vulnerability falls under CWE-791 (Incomplete Filtering of Special Elements), where the application fails to properly sanitize user-controlled input before processing it through the Jinja2 template engine. The ChatPromptTemplate function in the prompt handling module accepts user-supplied prompt data without adequate validation, allowing attackers to inject malicious template directives.

Jinja2 is a powerful templating engine for Python that supports arbitrary code execution through its expression evaluation capabilities. When user input is directly rendered through Jinja2 without proper sanitization, attackers can inject template syntax that gets executed server-side. This can lead to unauthorized access to system resources, execution of arbitrary Python code, and potential full system compromise.

The vulnerability can be exploited remotely over the network by an authenticated attacker with high privileges. Successful exploitation could result in limited impacts to confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is the improper handling of user-supplied input in the ChatPromptTemplate function. The Prompt argument is processed by the Jinja2 template engine without adequate filtering of special template elements. This allows specially crafted template syntax to bypass input validation and execute arbitrary expressions within the template context.

The vulnerable component does not implement proper input sanitization or template sandboxing, which would normally prevent dangerous template operations from being executed. The lack of a secure Jinja2 environment configuration (such as using SandboxedEnvironment) exacerbates the issue.

Attack Vector

The attack is conducted remotely over the network. An attacker with authenticated access and elevated privileges can craft malicious prompt input containing Jinja2 template syntax. When this input is processed by the ChatPromptTemplate function, the template engine evaluates the injected expressions, potentially allowing the attacker to access sensitive data, read files, or execute system commands.

The attack flow involves submitting specially crafted Jinja2 expressions as prompt input. These expressions bypass the incomplete filtering mechanism and are evaluated by the template engine. Common SSTI payloads target Python's object introspection capabilities to access dangerous classes and methods.

For technical details on the exploitation mechanism, refer to the GitHub Disclosure Document and the GitHub PoC Section.

Detection Methods for CVE-2026-2969

Indicators of Compromise

• Unusual Jinja2 template syntax patterns in application logs, particularly in prompt input fields
• Presence of Python introspection patterns such as __class__, __mro__, __subclasses__, or __globals__ in request data
• Unexpected file access or command execution originating from the datapizza-ai application process
• Error messages revealing template engine internals or stack traces related to Jinja2 rendering

Detection Strategies

• Implement input validation rules to detect and block common SSTI payloads containing double curly braces {{ }} or {% %} syntax
• Monitor application logs for template rendering errors or exceptions that may indicate exploitation attempts
• Deploy web application firewall (WAF) rules specifically designed to detect template injection patterns
• Use runtime application self-protection (RASP) solutions to detect anomalous template engine behavior

Monitoring Recommendations

• Enable verbose logging for the prompt handling module to capture all input processed by ChatPromptTemplate
• Set up alerts for process execution or file access events originating from the datapizza-ai application
• Monitor network traffic for exfiltration attempts following potential SSTI exploitation
• Implement anomaly detection for unusual patterns in prompt submissions

How to Mitigate CVE-2026-2969

Immediate Actions Required

• If possible, restrict access to the affected ChatPromptTemplate function to trusted users only
• Implement strict input validation to filter out template syntax from prompt inputs
• Consider disabling or replacing the vulnerable Jinja2 Template Handler component until a patch is available
• Apply network-level access controls to limit exposure of the affected application

Patch Information

At the time of publication, no official patch has been released by the vendor. According to the disclosure, the vendor was contacted early about this vulnerability but did not respond. Organizations using datapizza-ai version 0.0.2 should implement the workarounds described below and monitor for vendor updates.

For additional information, refer to the VulDB entry #347336.

Workarounds

• Migrate to using Jinja2's SandboxedEnvironment instead of the standard environment to restrict dangerous operations
• Implement a whitelist-based input validation approach that only allows known-safe characters in prompt inputs
• Deploy the application behind a reverse proxy with WAF rules configured to block SSTI patterns
• Consider replacing the Jinja2 template handler with a safer alternative that does not support arbitrary code execution

# Example: Restricting access to the vulnerable endpoint via nginx
location /api/prompt {
    # Limit access to trusted IP addresses only
    allow 10.0.0.0/8;
    deny all;
    
    # Additional WAF-like pattern blocking
    if ($request_body ~* "(\{\{|\{\%).*(__class__|__mro__|__subclasses__)") {
        return 403;
    }
    
    proxy_pass http://datapizza-backend;
}