Server-Side Template Injection in the Notification System

mercure is an open-source DICOM orchestration platform; we appreciate the maintainers' prompt, constructive response to this report. When a DICOM series matches a routing rule, mercure can fire a notification whose body is an administrator-configured template.

That body is rendered with Jinja2's bare Template(), with no SandboxedEnvironment, no autoescape, and no validation of the template content:

from jinja2 import Template

def parse_payload(payload, event, rule_name, task_id, details="", context={}, *,
                  task=None, tags_list=None):
    payload_parsed = payload
    payload_parsed = payload_parsed.replace("@rule@", rule_name)
    payload_parsed = payload_parsed.replace("@task_id@", task_id)
    payload_parsed = payload_parsed.replace("@event@", event.name)
    # ... context setup ...
    return Template(payload_parsed).render(context)  # unsandboxed Jinja2

Jinja2's default environment permits attribute access, so the same object-traversal that defeats the routing-rule eval() sandbox applies here: from a string literal one reaches the base object class, enumerates its subclasses, and recovers __import__ for arbitrary command execution. The vendor's 0.4.1 release notes confirm the templates were "rendered without sandboxing, allowing arbitrary code execution on every matching DICOM series." We are not publishing a working payload.

The notification template fields receive no sanitization. strip_untrusted() is applied to the tags field but not to any notification body:

notification_payload_body=form.get("notification_payload_body", ""),  # no sanitization
notification_email_body=form.get("notification_email_body", ""),      # no sanitization

Storing a notification body on a rule, pointing the webhook at any URL, and leaving the reception trigger enabled (the default for new rules) is enough: the router renders the template on every matching series, before the webhook is sent, so the injected code runs in the router process. That process reaches the shared filesystem, Redis, the DICOM data in transit, and other containers, which is the scope change. The payload persists in mercure.json and is valid Jinja2, so it resembles a normal template.

Command execution as the mercure user in the router is confirmed by the output of an injected id:

uid=1000(mercure) gid=1000(mercure) groups=1000(mercure)