CVE-2024-41950

Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in Haystack use Jinja2 templates, if anyone can create and render that template on the client machine they run any code. The vulnerability has been fixed with Haystack `2.3.1`.

• CWE-1336

• https://github.com/deepset-ai/haystack/commit/3fed1366c448b02189851bf08166c1f6477a02b0
• https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e
• https://github.com/deepset-ai/haystack/pull/8095
• https://github.com/deepset-ai/haystack/pull/8096
• https://github.com/deepset-ai/haystack/releases/tag/v2.3.1
• https://github.com/deepset-ai/haystack/security/advisories/GHSA-hx9v-6r9f-w677

Published

Jul 31, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41945fuels-ts is a library for interacting with Fuel v2. The typ…3.1
• CVE-2024-41946REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a …7.5
• CVE-2024-41947XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-41948biscuit-java is the java implementation of Biscuit, an authe…5
• CVE-2024-41949biscuit-rust is the Rust implementation of Biscuit, an authe…6.4
• CVE-2024-4195Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x bef…2.7
• CVE-2024-41951Pheonix App is a Python application designed to streamline v…4.4
• CVE-2024-41952Zitadel is an open source identity management system. ZITADE…5.3
• CVE-2024-41953Zitadel is an open source identity management system. ZITADE…6.1
• CVE-2024-41954FOG is a cloning/imaging/rescue suite/inventory management s…7.8
• CVE-2024-41955Mobile Security Framework (MobSF) is a security research pla…5.4
• CVE-2024-41956Soft Serve is a self-hostable Git server for the command lin…8.1