Attributed metadata history
Up to 100 retained publisher events per page for 10d337aab017fed22c3d2557ac33cf792fcdfef4a68e2d2b66676e986b772c9f. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_8c9cbb830c20534205
observed · 2026-10-12 18:48:03 UTC
available
Fingerprint: fcb07e12b5e83484e3eadc8c9f007c46a2c1ce2aa17c7bf38c70829f6cf28b17
intelligence_src_8c9cbb830c20534205
observed · 2026-10-12 18:48:03 UTC
Fixed Security Issues Code Execution by Custom Template Variables A security issue was identified in the template vars feature, where usage of untrusted processing pipelines can lead to unintended code execution by usage of the template vars feature. While the code execution of the vars feature is intentional, users of the pySigma library and developers using the library in their projects might not be aware that processing pipelines can imply execution of arbitrary code. Exploitation of the issue requires usage of pipelines that were created with malicious intent. Common scenarios are: Usage of publicly shared processing pipelines without verification. Web applications where processing pipelines are provided by untrusted users. CI/CD compromise: a pull request or imported artifact introduces a crafted processing pipeline, leading to command execution during automated rule conversion. The issue was mitigated by: The template vars feature must be explicitly activated with the allow_template_vars parameter on the ProcessingPipeline, ProcessingItem, QueryPostprocessingItem or one of the templating transformations. Alternatively, the feature can be enabled by the PYSIGMA_ALLOW_VARS_E
Fingerprint: 62c4861783ce89d854129d0f7d3eac09d8be79e0a1f058bce246fb802c9b9828