Anzuukino

A Server-Side Template Injection (SSTI) exists in the prompt generator located in `rag/prompts/generator.py`. This issue allows authenticated users to execute arbitrary operating system commands on the server. An attacker can trigger this by registering a normal account and creating a Canvas workflow utilizing a DuckDuckGo and LLM component chain. SSTI is a vulnerability where an attacker can inject malicious code into a template, which is then executed by the server's template engine.

Drupal core contains an improperly controlled modification of dynamically-determined object attributes, leading to Object Injection. This allows for potential manipulation of objects within the system.

The issue is related to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability, which allows Object Injection in Drupal core.