CVE-2022-37767
Pebble Templates protection mechanism bypass can lead to arbitrary code execution
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
- Record
CVE-2022-37767- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
- Record
CVE-2022-37767- Updated
- 2026-11-02
EUVDEUVD-2022-6972 No score
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
- Record
EUVD-2022-6972- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wxx5-w9jc-48wx
Pebble Templates protection mechanism bypass can lead to arbitrary code execution
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.
- Record
GHSA-wxx5-w9jc-48wx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-wxx5-w9jc-48wx
Pebble Templates protection mechanism bypass can lead to arbitrary code execution
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.
- Record
GHSA-wxx5-w9jc-48wx- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV No score
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
- Record
CVE-2022-37767- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.pebbletemplates:pebbleMaven |
through 3.1.5 | None known |
io.pebbletemplates:pebbleMaven |
through 3.1.5, plus listed versions 2.5.02.5.12.6.02.6.12.6.2 Show 17 moreShow less3.0.03.0.0.BETA013.0.13.0.103.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.23.1.33.1.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-37767 is a critical vulnerability (CVSS 9.8) in Pebbletemplates Pebble Templates, published September 12, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile.