Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks
5Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.7
exploitation probability
—
observed exploitation
nono source reports it
Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job.id > 100 %} conditional gating bypass both
the AST check and the test-render (stub has small job.id).
At runtime, the gated branch executes and exceptions write
full tracebacks into notification body, which is POSTed
to attacker-controlled webhook URL. Leaks install paths,
Python version, source line numbers.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N