Haystack Vulnerability Allows Remote Code Execution

CVE-2024-41950

Summary

The Haystack framework, developed by Deepset AI, is designed for building applications with large language models (LLMs) and Transformer architectures, facilitating features like vector searches. A significant vulnerability exists where clients allowing users to create and run Pipelines from scratch are at risk. This arises from the misuse of Jinja2 templates; if a malicious actor can create and render these templates on a client machine, they gain the ability to execute arbitrary code. To address this security flaw, users are advised to upgrade to Haystack version 2.3.1, which includes necessary fixes to eliminate this vulnerability.

References