CVE-2021-44657

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.

• https://github.com/StackStorm/st2/pull/5359Patch, Third Party Advisory
• https://github.com/pallets/jinja/issues/549Exploit, Issue Tracking, Third Party Advisory
• https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/Exploit, Third Party Advisory
• https://stackstorm.com/2021/12/16/stackstorm-v3-6-0-released/Release Notes, Vendor Advisory
• https://github.com/StackStorm/st2/pull/5359Patch, Third Party Advisory
• https://github.com/pallets/jinja/issues/549Exploit, Issue Tracking, Third Party Advisory
• https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/Exploit, Third Party Advisory
• https://stackstorm.com/2021/12/16/stackstorm-v3-6-0-released/Release Notes, Vendor Advisory

Published

Dec 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4465ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pr…8.7
• CVE-2021-44650Zoho ManageEngine M365 Manager Plus before Build 4419 allows…7.2
• CVE-2021-44651Zoho ManageEngine CloudSecurityPlus before Build 4117 allows…8.8
• CVE-2021-44652Zoho ManageEngine O365 Manager Plus before Build 4416 allows…7.8
• CVE-2021-44653Online Magazine Management System 1.0 contains a SQL injecti…9.8
• CVE-2021-44655Online Pre-owned/Used Car Showroom Management System 1.0 con…9.8
• CVE-2021-44659Adding a new pipeline in GoCD server version 21.3.0 has a fu…9.8
• CVE-2021-4466IPCop versions up to and including 2.1.9 contain an authenti…8.7
• CVE-2021-44662A Site Scripting (XSS) vulnerability exists in the Xerte Pro…6.1
• CVE-2021-44663A Remote Code Execution (RCE) vulnerability exists in the Xe…9.8
• CVE-2021-44664An Authenticated Remote Code Exection (RCE) vulnerability ex…8.8
• CVE-2021-44665A Directory Traversal vulnerability exists in the Xerte Proj…6.5