CVE-2022-45132
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be...
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
- Record
CVE-2022-45132- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
- Record
CVE-2022-45132- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2022-48049
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
- Record
EUVD-2022-48049- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wjxx-hxfj-hfmh
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be...
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
- Record
GHSA-wjxx-hxfj-hfmh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
- Record
CVE-2022-45132- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-45132 No score
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
- Record
DEBIAN-CVE-2022-45132- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lavaDebian:12 |
before 2023.01-1 | 2023.01-1 |
lavaDebian:14 |
before 2023.01-1, plus listed versions 2018.10-12018.11-12018.11-1~bpo9+12018.5-12018.5-2 Show 26 moreShow less2018.5-32018.5-3~bpo9+12018.5.post1-12018.5.post1-22018.5.post1-2~bpo9+12018.5.post1-32018.5.post1-42019.01-12019.01-22019.01-32019.01-42019.01-52019.10-12020.05-12020.06-12020.06-22020.12-12020.12-22020.12-32020.12-42020.12-52022.01.3-12022.01.3-22022.01.3-32022.01.3-3.12022.10-1 |
2023.01-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-45132 is a critical vulnerability (CVSS 9.8) in Linaro Lava, published November 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.09%, the 81st percentile. Fixed in lava 2023.01-1.
References
podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates
lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY
nvd.nist.gov/vuln/detail/CVE-2022-45132
github.com/advisories/GHSA-wjxx-hxfj-hfmh
security-tracker.debian.org/tracker/CVE-2022-45132