Jinja2 Execution Vulnerability in SOCFortress CoPilot Affects Security Operations

CVE-2026-61707

What is CVE-2026-61707?

A potential code execution vulnerability exists in SOCFortress CoPilot where case-report templates uploaded by users with the lowest-privilege portal role are executed by non-sandboxed Jinja2 engines. This occurs when admins or analysts generate reports, allowing an attacker to replace a legitimate template with a malicious one. The vulnerability stems from insufficient validation of template content and a shared global store of templates. The compromised functionality could lead to the execution of attacker-controlled Jinja expressions, potentially exposing sensitive incident data and SIEM credentials. This issue affects all deployments of CoPilot prior to version 0.1.76.

References