Disclosed vulnerability
CVE-2024-41950: RCE via insecure Jinja2 templates rendered in Haystack components
AIR-2024-0027 AIR record · 2024-07-haystack-jinja2-template-rce
From the supporting source
Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code.github.com
The record
Disclosed
2024-07-31
Vendor
deepset
Product
Haystack (haystack-ai)
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target — conventional Jinja2 SSTI in an LLM framework
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
User supplied pipeline template
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
haystack-ai < 2.3.1 in any deployment that lets users build or render custom pipelines
Capability abused
Defense & remediation
Recorded defense
none - templates were rendered with an unsandboxed Jinja2 environment
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
haystack-ai 2.3.1 (PRs #8095 and #8096)
Taxonomy & references
Curator notes
GHSA-hx9v-6r9f-w677, CVSS 7.7 High, published 2024-07-31. Prompt templates are a recurring SSTI surface in LLM frameworks; a sibling advisory GHSA-gphh-9q3h-jgpp / CVE-2026-44209 covers the same class in the 'banks' prompt-template library. Note that django-haystack shares the CVE-2024-41950 identifier in the GitHub advisory listing but is an unrelated Django search package.
Supporting sources
Cite as
Enkrypt AI. "CVE-2024-41950: RCE via insecure Jinja2 templates rendered in Haystack components". AIR, AIR-2024-0027. https://agentincident.vercel.app/i/AIR-2024-0027/ (accessed 2026-10-19).