What’s Vulnerable › Vulnerabilities

CVE-2026-77177

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-09-30
• Weakness: CWE-94

Description

Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluation without sanitization.

References

• https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb
• https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb

Get alerted when CVE-2026-77177 or the next vulnerability affects your stack