Summary
CVE-2026-77177 is a critical server-side template injection (SSTI) vulnerability in OGX, also known as Open GenAI Stack or ogx-ai (the project formerly known as Llama Stack), version 2026-06-11. The flaw allows an unauthenticated, remote attacker to achieve arbitrary code execution by submitting a crafted prompt that is evaluated as a Jinja2 template without sanitization. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) and is notable because the affected component is described as being used in the Meta AI backend for WhatsApp and other products.
Technical details
- Root cause: User-supplied prompt content is passed into Jinja2 template rendering logic without input sanitization or sandboxing, allowing attacker-controlled template expressions to be evaluated server-side.
- Trigger conditions: An attacker submits a chat/prompt input containing Jinja2 template syntax (e.g.,
{{ ... }}) to a service built on the vulnerable OGX component; no authentication or user interaction beyond message submission is required. - Attack vector: Network — the malicious prompt can be delivered remotely through any user-facing interface that forwards input into the vulnerable prompt-processing pipeline (e.g., a chat/messaging integration).
- Impact: Successful exploitation of the SSTI allows traversal of Python object attributes (e.g., reaching
__class__.__init__.__globals__) to obtain references to modules such asos, enabling execution of arbitrary OS commands with the privileges of the backend process — resulting in full confidentiality, integrity, and availability compromise. - A public proof-of-concept demonstrates confirming template evaluation (e.g.,
{{7*7}}) followed by a payload that invokesos.popen()to execute shell commands.
Affected software
- OGX / Open GenAI Stack (aka ogx-ai), version dated 2026-06-11
- Deployments of this component as used in the Meta AI backend for WhatsApp and other products
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: As of publication, no vendor-issued patched version has been identified for this specific vulnerability. Organizations running OGX/ogx-ai should monitor the project’s official repository and release notes for a fix addressing this SSTI issue and apply it as soon as it becomes available.
- If no patch is available:
- Do not pass raw, unsanitized user/prompt input directly into Jinja2 (or any other template engine’s) rendering or evaluation functions.
- Where template rendering of user input is required, use a sandboxed environment (e.g., Jinja2’s
SandboxedEnvironment) and strictly disallow attribute access to Python internals. - Restrict network exposure of the affected service and place it behind authentication and a web application firewall capable of detecting SSTI payloads (e.g., patterns like
{{,__class__,__globals__,popen). - Run the backend service with least-privilege OS accounts and containment (e.g., non-root containers, restricted egress) to limit the blast radius of any successful code execution.
- Monitor logs for anomalous prompt content containing template syntax or attribute-traversal patterns indicative of exploitation attempts.