CVE-2025-6518
PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine
A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Es wurde eine kritische Schwachstelle in PySpur-Dev pyspur bis 0.1.18 ausgemacht. Dabei betrifft es die Funktion SingleLLMCallNode der Datei backend/pyspur/nodes/llm/single_llm_call.py der Komponente Jinja2 Template Handler. Mittels Manipulieren des Arguments user_message mit unbekannten Daten kann eine improper neutralization of special elements used in a template engine-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
Improper Neutralization of Special Elements Used in a Template Engine
Incomplete Filtering of Special Elements
| 2025-06-23: | Advisory disclosed |
| 2025-06-23: | VulDB entry created |
| 2025-06-23: | VulDB entry last update |
vuldb.com/?id.313638 (VDB-313638 | PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine)
vuldb.com/?ctiid.313638 (VDB-313638 | CTI Indicators (IOB, IOC, TTP, IOA))
vuldb.com/?submit.593612 (Submit #593612 | PySpur-Dev pyspur <=v0.1.18 Remote Code Execute)
github.com/PySpur-Dev/pyspur/issues/289
Support options
