Vulnerabilities
Products Security index
Vulnerabilities
CVE-2026-85514
StackStorm st2 API Key auth.py privileges management
CVE-2026-85513
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
CVE-2022-43706
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.
CVE-2022-44009
Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information.
CVE-2021-44657
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.
