[GHSA-hj8m-9fhf-v7jp] Add CWE-1336 for fief-server SSTI

[yhay81]

Updates

• CWEs

Comments

This advisory currently has no CWE assigned. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) is a direct root-cause mapping:

• The maintainer advisory explicitly identifies the vulnerability as server-side template injection in Jinja templates.
• The published fix replaces the regular jinja2.Environment with ImmutableSandboxedEnvironment and adds tests that reject unsafe template expressions.
• CWE-1336 explicitly covers SSTI and recommends using a template engine's sandbox or restricted mode.

This is an already-public metadata correction only; it does not add new vulnerability details or proof-of-concept material.

References:

• Maintainer advisory: GHSA-hj8m-9fhf-v7jp
• Fix commit: fief-dev/fief@91e5662
• Fixed release: https://github.com/fief-dev/fief/releases/tag/v0.25.3
• CWE-1336: https://cwe.mitre.org/data/definitions/1336.html

Validation:

• JSON syntax checked with python3 -m json.tool
• Record validated against the current OpenSSF OSV JSON Schema
• One advisory file changed