NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
CRITICAL severity

fief-server Server-Side Template Injection vulnerabilityGHSA-hj8m-9fhf-v7jp

CRITICALFix: fief-dev/fief@91e5662

GHSA-hj8m-9fhf-v7jp is a critical-severity (CVSS 10) vulnerability in fief-server. A fix is available for fief-server — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 2, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍fief-server

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Server-Side Template Injection

Overview of the Vulnerability

Server-Side Template Injection (SSTI) is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed.

An attacker can use SSTI to execute code on the underlying system by manipulating values within the embedded template. When code is executed within the underlying system, it can allow an attacker to run permissioned commands under the exploited process, or exploit Cross-Site Scripting (XSS) to run code within the user's browser.

Business Impact

SSTI can lead to reputational damage for the business due to a loss in confidence and trust by users. If an attacker successfully executes code within the underlying system, it can result in data theft and indirect financial losses.

Steps to Reproduce

  1. Sign up and login to your account
  2. Use a browser to navigate to: email-templates {{URL}}
  3. put your payload in Edit Base template {{ cycler.__init__.__globals__.os.popen('id').read() }} and you will se it will execute.

Payload: {{ cycler.__init__.__globals__.os.popen('id').read() }}

Proof of Concept (PoC)

The screenshot(s) below demonstrates the SSTI:

SSTI

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIfief-server≥ 0.19.0&&< 0.25.30.25.3pip install --upgrade 'fief-server==0.25.3'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fief-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update fief-server to 0.25.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hj8m-9fhf-v7jp is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

# Server-Side Template Injection ## Overview of the Vulnerability Server-Side Template Injection (SSTI) is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to execute code on the underlying system by manipulating values within the embedded template. When code is executed within the underlying system, it can allow an attacker to run permissioned commands under the exploited process, or exploit Cross-Site Scripting (XSS) to run code within the user's br
O3 Security · Impact-Aware SCA

Is GHSA-hj8m-9fhf-v7jp in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
fief-server Server-Side Template Injection vulnerability