Summary
Open GenAI Stack contains a server-side expression evaluation flaw in its prompt-processing workflow. A crafted prompt containing template syntax may execute attacker-controlled expressions on the backend when input is processed without adequate sanitization, potentially resulting in arbitrary code execution.
Affected context
The vulnerability occurs in Open GenAI Stack deployments that process user-controlled prompts through Jinja2 or a similar template engine. Risk increases when prompt content is incorporated into templates and evaluated without strict separation between data and executable template logic, including deployments supporting Meta AI backend integrations or other connected products.
Exploit preconditions
- Attack surface: Prompt-processing or AI backend interfaces that accept attacker-influenced text
- Required access: The ability to submit or influence prompts reaching the vulnerable template-rendering workflow
- Trigger point: Server-side processing of prompt content containing template expressions
- Why exploitation is possible: Template syntax is evaluated as executable server-side logic because input is not sufficiently sanitized or isolated from the template engine
Why this happens
The underlying bug is a server-side template injection condition mapped to CWE-94: Improper Control of Generation of Code. Untrusted prompt content is allowed to reach a Jinja2 expression-evaluation context, causing data intended for model interaction to be interpreted as template logic. The insecure pattern is treating user-controlled text as part of an executable template rather than as inert data.
Potential impact
- An attacker may execute arbitrary code in the backend process context
- Sensitive application secrets or environment data could be exposed
- Connected services, models, or data stores may be accessed or modified
- The AI backend could be used for persistence, lateral movement, or service disruption
- Downstream products may experience data integrity or supply-chain risks
General mitigation guidance
Mitigation generally focuses on ensuring that untrusted prompts remain data throughout processing.
Common defensive patterns include:
- Avoiding evaluation of user-controlled text as a template
- Using fixed templates with explicit variable binding and strict allowlists
- Disabling unnecessary template features, functions, filters, and object access
- Applying context-aware validation before template processing
- Separating prompt rendering from privileged backend operations
- Running the service with least privilege and tightly scoped access to secrets and connected systems
- Enforcing isolation boundaries so a compromised worker cannot freely reach internal resources
How teams detect issues like this
Organizations can look for server-side template injection risks through:
- Static analysis rules identifying template rendering of request, prompt, or message content
- Code review checks for concatenation of untrusted text into Jinja2 templates
- Dependency and configuration reviews for enabled template features or unrestricted expression evaluation
- Runtime monitoring for unexpected template errors, expression markers, child processes, or unusual outbound connections
- Policy enforcement requiring fixed templates, explicit variable binding, and security tests for prompt-processing paths
Automated code review and application security testing tools may help identify unsafe data-to-template flows.
