CVE-2026-34172: Giskard Python Library RCE Vulnerability

CVE-2026-34172 Overview

CVE-2026-34172 is a critical remote code execution vulnerability in Giskard, an open-source Python library designed for testing and evaluating agentic systems. The vulnerability exists in the ChatWorkflow.chat() method, which passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. This design flaw allows attackers to achieve full remote code execution through Jinja2 class traversal when developers pass user input to this method.

The method name chat and parameter name message naturally invite developers to pass user input directly, but the string is silently parsed as a Jinja2 template rather than treated as plain text. This creates a dangerous situation where seemingly innocuous chat functionality becomes a vector for arbitrary code execution.

Critical Impact

Attackers can achieve full remote code execution on systems running vulnerable versions of Giskard by exploiting the unsandboxed Jinja2 template processing in the ChatWorkflow.chat() method.

Affected Products

• Giskard versions prior to 0.3.4
• Giskard versions prior to 1.0.2b1

Discovery Timeline

• 2026-03-31 - CVE-2026-34172 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34172

Vulnerability Analysis

This vulnerability is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The core issue stems from the ChatWorkflow.chat(message) method accepting a string parameter that is directly processed by Jinja2's template engine without any sandboxing or input sanitization.

Jinja2 template injection vulnerabilities are particularly dangerous because they can lead to arbitrary code execution. When user-controlled input is passed to an unsandboxed Jinja2 Environment, attackers can leverage Python's object introspection capabilities to traverse the class hierarchy and access dangerous functions like os.system() or subprocess.Popen().

The attack requires network access and low privileges, with some preparation needed for exploitation. Upon successful exploitation, attackers gain high-impact capabilities across confidentiality, integrity, and availability of the vulnerable system.

Root Cause

The root cause is improper handling of user input in the ChatWorkflow.chat() method. The developers designed the method with parameter names (chat, message) that naturally encourage passing user input, but internally the method treats this input as a Jinja2 template source rather than plain text. The use of a non-sandboxed Jinja2 Environment compounds this issue, as it provides no restrictions on template capabilities.

Attack Vector

The attack vector is network-based, requiring an attacker to provide malicious input to the ChatWorkflow.chat() method. In a typical exploitation scenario, an attacker crafts a specially formatted string containing Jinja2 template syntax that leverages Python's method resolution order (MRO) to access base classes and ultimately invoke system commands.

The attack follows the standard Jinja2 Server-Side Template Injection (SSTI) pattern where attackers use constructs like {{ ''.__class__.__mro__[1].__subclasses__() }} to traverse the object hierarchy and locate classes that can be used to execute arbitrary commands. Since the Jinja2 Environment is not sandboxed, there are no restrictions preventing this class traversal technique.

For technical exploitation details and proof-of-concept examples, refer to the GitHub Security Advisory GHSA-frv4-x25r-588m.

Detection Methods for CVE-2026-34172

Indicators of Compromise

• Presence of Jinja2 template syntax patterns in application logs, particularly strings containing {{ and }} with class traversal patterns like __class__, __mro__, or __subclasses__
• Unexpected process spawning from Python processes running Giskard
• Unusual network connections originating from Giskard application processes
• Log entries showing error messages related to Jinja2 template rendering failures with suspicious payloads

Detection Strategies

• Implement application-level logging to capture all input passed to ChatWorkflow.chat() and flag inputs containing Jinja2 template syntax
• Deploy web application firewall (WAF) rules to detect and block Server-Side Template Injection (SSTI) payload patterns
• Monitor for process execution anomalies where Giskard processes spawn unexpected child processes
• Use static code analysis tools to identify code paths where user input flows into ChatWorkflow.chat() without sanitization

Monitoring Recommendations

• Configure runtime application self-protection (RASP) solutions to monitor template engine operations
• Implement alerting for any Jinja2-related exceptions or errors that may indicate exploitation attempts
• Monitor system call patterns from Giskard processes for indicators of command injection
• Review application logs regularly for evidence of template injection attempts

How to Mitigate CVE-2026-34172

Immediate Actions Required

• Upgrade Giskard to version 0.3.4 or later for the 0.3.x branch
• Upgrade Giskard to version 1.0.2b1 or later for the 1.x branch
• Audit code to identify all locations where user input may be passed to ChatWorkflow.chat()
• Implement input validation to reject any input containing Jinja2 template syntax before it reaches the vulnerable method

Patch Information

The vulnerability has been patched in Giskard versions 0.3.4 and 1.0.2b1. Organizations should upgrade to these versions immediately. For detailed patch information and release notes, consult the GitHub Security Advisory.

Workarounds

• Implement strict input validation to sanitize or reject any user input containing Jinja2 template delimiters ({{, }}, {%, %}) before passing to ChatWorkflow.chat()
• Wrap calls to ChatWorkflow.chat() with a preprocessing function that escapes or removes template syntax
• Restrict network access to applications using Giskard to trusted sources only until patching is complete
• Consider running Giskard in an isolated environment with minimal system privileges to limit the impact of potential exploitation

# Example: Upgrade Giskard to patched version
pip install --upgrade giskard>=0.3.4

# Or for the 1.x branch
pip install --upgrade giskard>=1.0.2b1