Giskard Agents contain a server‑side template injection flaw. The ChatWorkflow.chat() method accepts a message string and passes it directly to a Jinja2 Environment without sandboxing. Because the template engine is not sandboxed, an attacker who supplies crafted input can perform class traversal and execute arbitrary code on the system where the agent runs. The vulnerability is classified as CWE‑1336, a remote code execution weakness.

The issue affects the Giskard‑AI open‑source library, Giskard OSS, specifically the giskard-agent package. Versions prior to 0.3.4 and 1.0.2b1 are vulnerable, as identified by the provided CPE entries. The vulnerability is present in the ChatWorkflow.chat() method of the library’s agent component.

The CVSS score is 7.7, indicating high severity, while the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires an attacker to supply input to the chat() method, which can occur when untrusted data is processed through the library. Although broad exploitation is believed to be limited by the low EPSS, the potential impact of remote code execution is catastrophic; therefore, the overall risk is considered high and mitigation should be pursued urgently. Detailed exploitation steps are not provided in the description, so mitigation focuses on eliminating the risk vector rather than fixing it programmatically.