CVE-2026-91925

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91925
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91925.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91925
Published
2026-09-15T11:00:53Z
Modified
2026-09-17T03:47:27Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine
Details

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1336"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91925.json"
}
References

Affected packages

Git / github.com/polyaxon/cli

Affected ranges

Type
GIT
Repo
https://github.com/polyaxon/cli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bfea04a0bf93886f69a3195954204d9d010b55aa
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.16.4"
        },
        {
            "fixed": "2.16.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.20.0
v1.22.0
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc10
v2.0.0-rc11
v2.0.0-rc12
v2.0.0-rc13
v2.0.0-rc14
v2.0.0-rc15
v2.0.0-rc16
v2.0.0-rc17
v2.0.0-rc18
v2.0.0-rc19
v2.0.0-rc20
v2.0.0-rc21
v2.0.0-rc22
v2.0.0-rc23
v2.0.0-rc24
v2.0.0-rc25
v2.0.0-rc26
v2.0.0-rc28
v2.0.0-rc3
v2.0.0-rc30
v2.0.0-rc33
v2.0.0-rc36
v2.0.0-rc37
v2.0.0-rc38
v2.0.0-rc4
v2.0.0-rc40
v2.0.0-rc41
v2.0.0-rc44
v2.0.0-rc47
v2.0.0-rc48
v2.0.0-rc49
v2.0.0-rc5
v2.0.0-rc50
v2.0.0-rc52
v2.0.0-rc54
v2.0.0-rc6
v2.0.0-rc7
v2.0.0-rc8
v2.0.0-rc9
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.6-rc0
v2.0.6-rc3
v2.0.6-rc6
v2.1.0-rc10
v2.1.0-rc12
v2.1.0-rc16
v2.1.0-rc17
v2.1.0-rc3
v2.1.0-rc5
v2.1.0-rc7
v2.1.1
v2.1.1-rc0
v2.1.2
v2.1.2-rc0
v2.1.2-rc1
v2.1.3
v2.1.3-rc0
v2.1.3-rc1
v2.1.3-rc3
v2.1.4
v2.1.5
v2.1.6
v2.1.6-rc0
v2.1.7
v2.1.8
v2.10.0
v2.11.0
v2.11.1
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.16.2
v2.16.3
v2.2.0
v2.2.0-rc0
v2.3.0
v2.3.0-rc0
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.5.0
v2.5.0-rc3
v2.5.1
v2.5.2
v2.5.3
v2.6.0
v2.6.1
v2.7.0
v2.7.0-rc0
v2.8.0
v2.8.0-rc2
v2.8.1
v2.8.1-rc0
v2.8.1-rc2
v2.9.0
v2.9.0-rc0
v2.9.1
v2.9.2
v2.9.3
v2.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91925.json"