OpenMetadata servers earlier than 1.11.4 host a Server‑Side Template Injection in FreeMarker email templates, permitting an attacker with administrative privileges to embed arbitrary FreeMarker expressions that are evaluated on the server. The injection can result in remote code execution, giving the attacker full control over the host operating system. This flaw is classified as CWE‑1336 (Server‑Side Template Injection) and CWE‑94 (Code Injection).

The vulnerability impacts the open‑metadata:OpenMetadata product. Any deployment running a version lower than 1.11.4 is affected. Version 1.11.4 and later incorporate the necessary patch to eliminate the injection point.

The CVSS score of 8.5 indicates high severity, yet the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at present; the issue is not listed in CISA’s KEV catalog. Exploitation requires prior administrative access, so the risk is confined to environments where such privileges exist. An attacker would craft a malicious payload within an email template, causing the server to execute arbitrary commands on the underlying host.