{"answers":{"affected":"3 open source packages ship an affected version, including jupyter_enterprise_gateway and jupyter-enterprise-gateway. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44181 exists.","fix":"Upgrade jupyter_enterprise_gateway to 3.3.0 or later.","what":"CVE-2026-44181 is a critical code injection vulnerability in jupyter-server enterprise_gateway, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-44181 and fix it if it is affected.\n\nWhat it is: CVE-2026-44181 is a critical code injection vulnerability in jupyter-server enterprise_gateway, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44181 exists.\n\nAffected packages and fixed versions:\n- jupyter_enterprise_gateway (PyPI): affected from 2.0.0rc2; fixed in 3.3.0\n- jupyter-enterprise-gateway (PyPI): affected from 2.0.0rc2; fixed in 3.3.0\n- jupyter-enterprise-gateway (PyPI): affected from 2.0.0rc2; fixed in 3.3.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-44181/ (Markdown: https://insights.sbomify.com/CVE-2026-44181/index.md)","id":"CVE-2026-44181","markdown":"https://insights.sbomify.com/CVE-2026-44181/index.md","name":"CVE-2026-44181","record":{"aliases":["GHSA-f49j-v924-fx9w","PYSEC-2026-364"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Jupyter Enterprise Gateway","requires_auth":"none","summary":"Attackers can execute arbitrary code via Jinja2 template injection in Kubernetes manifests, potentially compromising the cluster.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"enterprise_gateway","vendor":"jupyter"}],"cvss":{"score":10,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"description":"Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables (KERNEL_XXX) used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection (SSTI). By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service. The code can use or steal the Kubernetes service account token, which can steal Kubernetes secrets and be used to fully compromise the Kubernetes cluster by scheduling a privileged pod or a pod with a hostPath volume mount. This issue has been fixed in version 3.3.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution","id":"CVE-2026-44181","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering","id":"CVE-2026-44182"},"packages":[{"ecosystem":"PyPI","fixed":["3.3.0"],"introduced":["2.0.0rc2"],"last_affected":[],"package":"jupyter-enterprise-gateway","purl":"pkg:pypi/jupyter-enterprise-gateway","source":"GHSA-f49j-v924-fx9w"},{"ecosystem":"PyPI","fixed":["3.3.0"],"introduced":["2.0.0rc2"],"last_affected":[],"package":"jupyter-enterprise-gateway","purl":"pkg:pypi/jupyter-enterprise-gateway","source":"PYSEC-2026-364"},{"ecosystem":"PyPI","fixed":["3.3.0"],"introduced":["2.0.0rc2"],"last_affected":[],"package":"jupyter_enterprise_gateway","purl":null,"source":"GHSA-f49j-v924-fx9w"}],"prev":{"headline":"Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed","id":"CVE-2026-44180"},"products":["enterprise_gateway"],"published":"2026-07-16","related":[{"cvss_score":10,"headline":"Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering","id":"CVE-2026-44182","kev_date_added":null,"published":"2026-07-16"},{"cvss_score":9.8,"headline":"Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed","id":"CVE-2026-44180","kev_date_added":null,"published":"2026-07-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-17","vendors":["jupyter-server"]},"summary":"Attackers can execute arbitrary code via Jinja2 template injection in Kubernetes manifests, potentially compromising the cluster.","url":"https://insights.sbomify.com/CVE-2026-44181/"}