Executive brief
Polyaxon is a machine learning platform for orchestrating and managing ML workflows and experiments. A vulnerability in versions through 2.16.4 allows authenticated users to inject malicious code through operation specification fields, which are processed by an unsandboxed Jinja2 templating engine on the server side. An attacker can exploit this to execute arbitrary operating system commands with the privileges of the scheduler process, potentially exposing sensitive credentials and service tokens used by the platform.
Technical details
The vulnerability is a server-side template injection (SSTI) flaw caused by rendering user-supplied operation specification fields (queue, namespace, conditions, presets, dependencies) through an unsandboxed Jinja2 environment. The vulnerable code in engine.py instantiates a basic Jinja2 Environment without any sandboxing restrictions or autoescape settings, then directly renders user-controlled template strings. Authentication is required to submit runs, but once authenticated, an attacker can craft payloads leveraging Jinja2's built-in functions and filters to break out of the template context and execute arbitrary Python code, resulting in OS command execution in the scheduler process context. This exposes database credentials, API tokens, and other sensitive service configuration stored in the process environment or accessible to the scheduler account.
Affected products
- Polyaxon Polyaxon through 2.16.4
Timeline
- 2026-09-15: disclosed