Threat Investigation
Request a demo

CVE-2024-7093

Critical

Description

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.

SeverityCritical
CVSS9.4
Exploit probability—
ProductDispatch
PublishedAug 1, 2024
First seenAug 1, 2024
Weakness typeCWE-94Code injection

How to fix

Update
  • Netflix Dispatchv20240731 or later

Affected products

ProductAffected versionsFixed in
Netflix Dispatchv < v20240731v20240731

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.