Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens.

Polyaxon versions through 2.16.4 are vulnerable to server-side template injection (SSTI) due to the use of an unsandboxed Jinja2 templating environment during server-side run preparation. Authenticated users can submit malicious Jinja2 payloads in operation specification fields such as queue, namespace, conditions, presets, or dependencies to achieve arbitrary code execution. The vulnerability is exploited in the context of the scheduler process, which can expose sensitive information including database credentials and service tokens. The flaw originates in the engine.py and sections.py files within the Polyaxon CLI codebase. This issue requires authentication but does not require elevated privileges, making it accessible to any registered user. Successful exploitation could lead to full system compromise, data exfiltration, and lateral movement within the infrastructure. The vulnerability has been documented by VulnCheck and reported via the Polyaxon GitHub issue tracker.