CVE-2025-9556: Gonja Default Env Ssti Arbitrary File Read
Template is rendered with gonja's default environment via gonja.FromString / gonja.FromBytes / gonja.FromFile. The default environment ships with an unrestricted filesystem loader, so Jinja2 composition directives in the template body (e.g. {% include "/etc/passwd" %}, {% extends %}, {% import %}, {% from %}) are resolved against the host filesystem. If any
Gogreprules fetch cve-2025-9556-gonja-default-env-ssti-arbitrary-file-read --engine opengrepDescription
Template is rendered with gonja's default environment via gonja.FromString / gonja.FromBytes / gonja.FromFile. The default environment ships with an unrestricted filesystem loader, so Jinja2 composition directives in the template body (e.g. {% include "/etc/passwd" %}, {% extends %}, {% import %}, {% from %}) are resolved against the host filesystem. If any
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.