Threat
NVD-CVE-2026-77177
Publication date unknown · Discovered nist.gov
Page published · Page updated
Publication date unknown · First observed: 12 Oct 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
CVE-2026-77177 shows prompt injection escalating into server-side template injection and remote code execution in a GenAI stack reportedly deployed behind widely used Meta AI/WhatsApp products, turning LLM input handling into a critical RCE vector.
CVE-2026-77177 affects Open GenAI Stack (aka ogx-ai), as used in the Meta AI backend for WhatsApp and other products, where prompt injection using Jinja2 template syntax enables unsanitized server-side expression evaluation and thus code execution. CISA-ADP rates it CVSS 9.8 critical (CWE-94, code injection), with a proof-of-concept referenced in a public gist.
Summary
CVE-2026-77177 is a critical code-execution vulnerability in Open GenAI Stack (aka ogx-ai) version 2026-06-11. A prompt injection carrying Jinja2 template syntax is evaluated server-side without sanitization, enabling server-side template injection (SSTI) that results in code execution. The component is reported as used in the Meta AI backend for WhatsApp and other products.[1]
CISA-ADP rated the issue 9.8 CRITICAL (CVSS 3.1, network vector, no privileges or user interaction, high confidentiality/integrity/availability impact) and classified it under CWE-94. NVD itself has not yet enriched the record, and the only published reference is a GitHub gist, consistent with a proof-of-concept disclosure rather than confirmed in-the-wild exploitation.[1]
Attack chain
- Injection: An attacker supplies a crafted prompt containing Jinja2 template syntax to the GenAI stack.[1]
- Server-side evaluation: The input reaches a Jinja2 template evaluation path and is evaluated server-side without sanitization (server-side template injection), achieving code execution.[1]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-06-11 | Version identifier of the affected Open GenAI Stack (ogx-ai) release referenced by the CVE.[1] |
| 2026-09-29 | CVE-2026-77177 published in NVD (source: MITRE).[1] |
| 2026-09-30 | NVD record last modified.[1] |
How it works
The vulnerability is a server-side template injection. User-controllable prompt content containing Jinja2 template syntax is passed into a template evaluation context and evaluated server-side without sanitization. Because Jinja2 expression evaluation can reach underlying objects and functions, this unsanitized evaluation enables code execution (CWE-94, code injection).[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Open GenAI Stack (aka ogx-ai), as used in the Meta AI backend for WhatsApp and other products | Version 2026-06-11 | No patch or fixed version stated in the NVD record; MITRE affected-product entry is listed as n/a and the only reference is a GitHub gist.[1] |
Key takeaways
- Prompt injection in LLM/GenAI backends can escalate beyond content manipulation to full server-side code execution when model inputs are passed into template engines such as Jinja2 without sanitization.[1]
- The issue carries a CISA-ADP CVSS 9.8 CRITICAL rating and is described with a public proof-of-concept gist, but NVD has not enriched it and no confirmed in-the-wild exploitation is documented in the evidence.[1]
Defensive actions
- Sanitize and sandbox any user-supplied or prompt-derived input before it reaches Jinja2 template rendering, and avoid evaluating untrusted content in a server-side template context.: The flaw arises because prompt-injected Jinja2 syntax is evaluated server-side without sanitization, yielding code execution.[1]