In Linaro Automated Validation Architecture (LAVA) prior to 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
linaro lava |
Vulmon