The vulnerability occurs in the custom batch code generation feature of InvenTree, where staff users can modify an embedded Jinja2 template. Through this misuse, a malicious template can access server‑side secrets or execute arbitrary code when the template is rendered via an API call by any user. The attack does not require network‑level access beyond normal API usage; it exploits a logical flaw in user privilege handling and template evaluation.

InvenTree, an open‑source inventory management system, is affected in releases prior to 1.2.3. All other versions after 1.2.3 (including 1.3.0 and later) contain the fix. No specific operating system or platform constraints are listed.

The CVSS score of 5.9 indicates a medium severity vulnerability. The EPSS score of less than 1 percent reflects a very low current exploitation probability, and the issue is not listed in CISA’s KEV catalogue. The likely attack vector is via a local or remote API request to the batch generation endpoint that requires the attacker to have initially staff‑level credentials to alter the template. Attack feasibility requires staff‑level permissions to modify the template, after which any user can trigger the harmful code via the batch‑generation API. Once the template has been corrupted, the malicious code is executed with the context of the calling user, potentially compromising confidentiality, integrity, or availability of server resources depending on the injected operations.