CVE-2021-44657

8.8 highEPSS 2.6%

High (8.8) in stackstorm stackstorm. EPSS 2.6% chance of exploitation in the next 30 days.

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
Published: 2021-12-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

stackstorm:stackstorm

References

https://github.com/StackStorm/st2/pull/5359
https://github.com/pallets/jinja/issues/549
https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/
https://stackstorm.com/2021/12/16/stackstorm-v3-6-0-released/
https://github.com/StackStorm/st2/pull/5359

Check your stack JSON