| Title | JumpServer 4.10.19 OS Command Injection |
|---|
| Description | JumpServer v4.10.19 lacks backend input filtering, making it vulnerable to SSTI injection, which can execute arbitrary system commands
In the backend management section, when adding an asset, the IP/HOST field contains SSTI (Service Scripting Instructions for Actions), which can be used to write command execution content. When the template is rendered, the SSTI is triggered, causing the command to execute |
|---|
| Source | ⚠️ https://gist.github.com/Seikruun/b628bb6d4403d9c41a54a4b92d775583 |
|---|
| User | seikruun (UID 100457) |
|---|
| Submission | 09/08/2026 18:03 (2 months ago) |
|---|
| Moderation | 10/19/2026 09:24 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422286 [JumpServer up to 4.10.19 Template Rendering IP/HOST os command injection] |
|---|
| Points | 19 |
|---|