CVE-2026-71463

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The notification template Jinja AST whitelist only inspects static Getattr nodes. This allows dynamic subscripts, such as job['job'+' env'], and conditional gating, such as {% if job.id > 100 %}, to bypass both the AST check and the test-render process. At runtime, the gated branch executes and exceptions write full tracebacks into the notification body, which is then POSTed to an attacker-controlled webhook URL. This process leaks sensitive information, including install paths, Python version, and source line numbers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.