GHSA-8gff-cf92-72pv
pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
External links from the advisory. They lead to third-party sites.