---
id: CVE-2026-91925
title: >-
  Polyaxon through 2.16.4 renders operation specification fields with an
  unsandboxed Jinja2 environment during server-side run preparation, allowing
  authenticated users to execute arbitrary code
summary: >-
  Polyaxon through 2.16.4 renders operation specification fields with an
  unsandboxed Jinja2 environment during server-side run preparation, allowing
  authenticated users to execute arbitrary code. Attackers can submit runs with
  Jinja2 paylo…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1336
vendor: polyaxon
product: polyaxon
affected:
  - polyaxon <= 2.16.4
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T13:16:46.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91925'
references:
  - url: >-
      https://github.com/polyaxon/cli/blob/bfea04a0bf93886f69a3195954204d9d010b55aa/cli/polyaxon/_polyaxonfile/specs/libs/engine.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/polyaxon/cli/blob/bfea04a0bf93886f69a3195954204d9d010b55aa/cli/polyaxon/_polyaxonfile/specs/sections.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/polyaxon/polyaxon'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/polyaxon/polyaxon/issues/1540'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/polyaxon-through-2.16.4-server-side-template-injection-via-unsandboxed-jinja2-engine
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T12:10:41.478937Z'
ingestedAt: '2026-09-15T11:36:07.420Z'
epss: 0.00476
epssPercentile: 0.4018
---

## Overview

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.