Vulnerability	Vulnerable Version
H Arbitrary Code Execution vault-cli is a Python 3.6+ tool that offers simple interactions to manipulate secrets from Hashicorp Vault. Affected versions of this package are vulnerable to Arbitrary Code Execution. When a secret starts with the prefix "`!template!`", `vault-cli` interprets the rest of the contents of the secret as a Jinja2 template. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code. ###Workaround Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand, e.g. `vault-cli --no-render get-all`) or adding `render: false` to the `vault-cli` configuration `yaml` file disables rendering and removes the vulnerability. Using the python library, you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely. How to fix Arbitrary Code Execution? Upgrade `vault-cli` to version 3.0.0 or higher.	[,3.0.0)

Arbitrary Code Execution

vault-cli is a Python 3.6+ tool that offers simple interactions to manipulate secrets from Hashicorp Vault.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When a secret starts with the prefix "!template!", vault-cli interprets the rest of the contents of the secret as a Jinja2 template. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code.

###Workaround Using the environment variable VAULT_CLI_RENDER=false or the flag --no-render (placed between vault-cli and the subcommand, e.g. vault-cli --no-render get-all) or adding render: false to the vault-cli configuration yaml file disables rendering and removes the vulnerability. Using the python library, you can use: vault_cli.get_client(render=False) when creating your client to get a client that will not render templated secrets and thus operates securely.

How to fix Arbitrary Code Execution?

Upgrade vault-cli to version 3.0.0 or higher.

[,3.0.0)

Go back to all versions of this package