{"id":"CVE-2022-45132","aliases":["DEBIAN-CVE-2022-45132","EUVD-2022-48049","GHSA-wjxx-hxfj-hfmh"],"status":"published","title":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be...","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02094,"percentile":0.81808,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2022-11-18T00:00:00Z","modified":"2026-10-15T08:03:06Z","fixes":[{"ecosystem":"Debian:12","package":"lava","fixed_in":["2023.01-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lava","fixed_in":["2023.01-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.01-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.01-1"}]}],"versions":["2018.10-1","2018.11-1","2018.11-1~bpo9+1","2018.5-1","2018.5-2","2018.5-3","2018.5-3~bpo9+1","2018.5.post1-1","2018.5.post1-2","2018.5.post1-2~bpo9+1","2018.5.post1-3","2018.5.post1-4","2019.01-1","2019.01-2","2019.01-3","2019.01-4","2019.01-5","2019.10-1","2020.05-1","2020.06-1","2020.06-2","2020.12-1","2020.12-2","2020.12-3","2020.12-4","2020.12-5","2022.01.3-1","2022.01.3-2","2022.01.3-3","2022.01.3-3.1","2022.10-1"]}],"products":[{"vendor":"linaro","product":"lava"}],"references":[{"url":"https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45132"},{"url":"https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY"},{"url":"https://lists.lavasoftware.org/archives/list/lava-announce@lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY"},{"url":"https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates"},{"url":"https://github.com/advisories/GHSA-wjxx-hxfj-hfmh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-45132","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-45132","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2025-04-30T14:36:37.228Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-48049","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","status":"published","published":"2022-11-18T00:00:00Z","modified":"2025-04-30T14:36:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:51:59.458406Z"}],"ghsa":[{"id":"GHSA-wjxx-hxfj-hfmh","title":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be...","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","status":"published","published":"2022-11-19T00:30:55Z","modified":"2025-04-30T15:30:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:02:04.725122Z"}],"nvd":[{"id":"CVE-2022-45132","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","status":"published","published":"2022-11-18T23:15:29.637Z","modified":"2026-06-17T05:09:25.193Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"CVE-2022-45132","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","status":"published","published":"2022-11-18T23:15:29.637Z","modified":"2026-03-14T11:57:24.302012Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-45132","description":"In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.","status":"published","published":"2022-11-18T23:15:29.637Z","modified":"2026-11-03T06:03:01.293038406Z","updated_at":"2026-11-03T06:43:01.507088Z"}]}}