Description
Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluation without sanitization.
Published: 2026-09-29
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is found in the Open GenAI Stack (ogx-ai) release of 2026‑06‑11. Prompt injection that injects Jinja2 template syntax is not sanitized, allowing the server to evaluate arbitrary expressions. An attacker can run arbitrary code on the host that runs the AI service, giving full compromise of confidentiality, integrity, and availability.

Affected Systems

The affected product is the Open GenAI Stack (ogx-ai) used in the Meta AI backend for WhatsApp and other downstream services. All installations running the 2026‑06‑11 release are potentially vulnerable; no further vendor or version details are available.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical level of risk. EPSS data are not provided and the vulnerability is not listed in the CISA KEV catalog, but the lack of input sanitization makes exploitation straightforward via the public prompt interface. The likely attack vector is remote exploitation through malicious prompts sent over the network, which can lead to full code execution on the underlying host.

Generated by OpenCVE AI on September 30, 2026 at 13:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Open GenAI Stack to the latest release that implements server‑side template sanitization or disables Jinja2 expression evaluation.
  • If an upgrade is not yet available, isolate the AI service behind a dedicated network boundary, restrict prompt inputs to a whitelist of safe constructs, and reject any Jinja2 syntax.
  • Run the AI container with the least privilege user and employ sandboxing or container isolation to contain any execution of malicious code.
  • Enable logging and monitoring of prompt content to detect and alert on injection attempts.

Generated by OpenCVE AI on September 30, 2026 at 13:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Title Server‑Side Code Execution via Prompt Injection in Open GenAI Stack

Wed, 30 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Title Server‑Side Code Execution via Prompt Injection in Open GenAI Stack

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluation without sanitization.
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-29T19:49:32.986Z

Reserved: 2026-08-20T00:00:00.000Z

Link: CVE-2026-77177

cve-icon Vulnrichment

Updated: 2026-09-29T19:49:28.747Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T16:17:11.363

Modified: 2026-09-30T17:32:07.107

Link: CVE-2026-77177

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T13:15:19Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')