Metabase, an open‑source data analytics platform, contains a server‐side template injection flaw in the notifications endpoint. In affected releases, authenticated users can place arbitrary templated expressions that are evaluated by the server when an email notification is generated. This enables extraction of sensitive data such as database credentials and can lead to remote code execution. The flaw is confirmed in all versions prior to 0.57.13 and in the 0.58.x series up through 0.58.6. A low‑privileged authenticated user can trigger this by requesting the notification endpoint.

Metabase users running the open‑source edition or the enterprise edition on any version earlier than 0.57.13, or any 0.58.x release before 0.58.7, are affected. Users of 0.57.13, 0.58.7, and later releases are not impacted.

The CVSS score of 7.7 indicates a high‑severity vulnerability with a potential impact of data exfiltration and remote code execution. The EPSS score of less than 1% implies that exploitation attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires authenticated access, an attacker must first obtain a user account and can then trigger the flaw via the notifications endpoint. Once invoked, the server evaluates the injected template and may expose sensitive information or execute arbitrary code.