CVE-2024-4879

Jelly Template Injection Vulnerability in ServiceNow UI Macros

9.3 CriticalIn KEVPublic exploit

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

100.0%Up 99.9 points since Jul 11, 2024

What each source reports

CVE List Score used 9.3

Jelly Template Injection Vulnerability in ServiceNow UI Macros

Record: CVE-2024-4879
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1287
Updated: 2026-11-02

EUVDEUVD-2024-44451 9.3

Record: EUVD-2024-44451
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-355h-wpr8-m2qx 9.3

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and...

Record: GHSA-355h-wpr8-m2qx
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1287
Updated: 2026-11-02

CISA KEV No score

ServiceNow Improper Input Validation Vulnerability

ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.

Record: CVE-2024-4879
Weakness: CWE-1287
Updated: 2026-11-02

NVD 9.3

Record: CVE-2024-4879
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1287
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Brut-Security/CVE-2024-4879	2024-07-12
PoC in GitHub	Mr-r00t11/CVE-2024-4879	2024-07-12
PoC in GitHub	bigb0x/CVE-2024-4879	2024-07-12
PoC in GitHub	GraySignal/CVE-2024-4879-ServiceNow	2024-07-16
PoC in GitHub	NoTsPepino/CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning	2024-07-28
PoC in GitHub	jdusane/CVE-2024-4879	2024-08-14
PoC in GitHub	gh-ost00/CVE-2024-4879	2024-08-27
PoC in GitHub	0xWhoami35/CVE-2024-4879	2024-09-13
Exploit-DB	ServiceNow Multiple Versions - Input Validation & Template Injection	2025-08-11
Nuclei	ServiceNow UI Macros - Template Injection

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-4879 is a critical vulnerability (CVSS 9.3) in Servicenow Now Platform, published July 10, 2024. CISA lists it as known to be exploited, since July 29, 2024. EUVD reports exploitation since July 29, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.