Server-Side Template Injection in Polyaxon by Vendor Polyaxon

CVE-2026-91925

What is CVE-2026-91925?

Polyaxon versions up to 2.16.4 are susceptible to a server-side template injection vulnerability caused by the use of an unsandboxed Jinja2 environment during the preparation of run specifications. Authenticated users can exploit this flaw by submitting runs that include Jinja2 payloads within the queue, namespace, conditions, presets, or dependencies fields. This exploitation allows attackers to execute arbitrary operating system commands in the context of the scheduler process, potentially exposing sensitive information such as database credentials and service tokens.

References