CVE-2026-31864

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges (Application Applet Management or Virtual Application Management permissions). Attackers can exploit this vulnerability to execute arbitrary code within the JumpServer Core container. The vulnerability arises from unsafe use of Jinja2 template rendering when processing user-uploaded YAML configuration files. When a user uploads an Applet or VirtualApp ZIP package, the manifest.yml file is rendered through Jinja2 without sandbox restrictions, allowing template injection attacks.

• CWE-1336

• https://github.com/jumpserver/jumpserver/pull/16608Issue Tracking
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-qx8h-rx2j-j5wcPatch, Vendor Advisory

Published

Mar 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31859Craft is a content management system (CMS). The fix for CVE-…6.1
• CVE-2026-3186A vulnerability was determined in feiyuchuixue sz-boot-paren…4.3
• CVE-2026-31860Unhead is a document head and template manager. Prior to 2.1…6.1
• CVE-2026-31861Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…8.8
• CVE-2026-31862Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…8.8
• CVE-2026-31863Anytype Heart is the middleware library for Anytype. The cha…4.4
• CVE-2026-31865Elysia is a Typescript framework for request validation, typ…5.3
• CVE-2026-31866flagd is a feature flag daemon with a Unix philosophy. Prior…7.5
• CVE-2026-31867Craft Commerce is an ecommerce platform for Craft CMS. Prior…4.8
• CVE-2026-31868Parse Server is an open source backend that can be deployed …6.1
• CVE-2026-31869Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-3187A vulnerability was identified in feiyuchuixue sz-boot-paren…9.8