CVE-2026-34172: Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-31 · updated 2026-07-24
Weakness: CWE-1336

Description

Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1.

Affected products

Giskard-Agent: before 0.3.4; 1.0.2-alpha1 — fixed in 0.3.4
Giskard-Agents: 1.0.1-alpha1

How to fix

Upgrade to a fixed version: Giskard-Agent 0.3.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-34172 or the next vulnerability affects your stack