Code Execution Vulnerability in Open GenAI Stack for Meta AI Products
CVE-2026-77177

9.8CRITICAL

Key Information:

Vendor

Meta

Status
Open GenAI Stack
Vendor
CVE Published:
29 September 2026

What is CVE-2026-77177?

The Open GenAI Stack, notably utilized in Meta's AI backend for applications like WhatsApp, is susceptible to a prompt injection flaw. This vulnerability enables attackers to execute arbitrary code through server-side expression evaluation using Jinja2 template syntax, as the system fails to sanitize user inputs adequately. This oversight poses significant risks, potentially allowing malicious actors to compromise system integrity and functionality.

References

https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cb...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.