Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters such as Apache Spark, Kubernetes, and Docker Swarm. In releases 2.0.0rc2 through 3.2.x, KERNEL_XXX environment variables embedded in the Kubernetes manifest are processed by the Jinja2 templating engine without sufficient sanitization, creating a Server‑Side Template Injection vulnerability. By including Jinja2 expressions, an attacker can cause the Gateway to execute arbitrary Python code and OS commands. The injected code can use or steal the Kubernetes service account token, permitting the retrieval of secret data and the creation of privileged pods or pods that mount hostPath volumes, thereby fully compromising the cluster. The issue was resolved in version 3.3.0, and the flaw is a Remote Code Execution vulnerability classified as CWE‑1336.

The affected product is Jupyter Server Enterprise Gateway. All releases from 2.0 up to but not including 3.3.0 are vulnerable. The issue is fixed in version 3.3.0.

The CVSS score is 10, indicating critical severity. The EPSS score is <1%, so the probability of exploitation in the wild is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker manipulating environment variable input during kernel launch via the Enterprise Gateway interface; however, the description does not fully specify the entry point, so this inference is based on the data that the vulnerability is triggered during the rendering of the Kubernetes manifest. Exploitation requires access to the Gateway service or the ability to submit kernel launch requests with crafted environment variable values.