CVE-2026-15519

MEDIUM

usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere

Title source: cna
STIX 2.1

Description

A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the file system_prompt.jinja of the component PyPI Handler. Performing a manipulation results in inclusion of functionality from untrusted control sphere. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Vdb Entry vdb-entry
VDB-377848 | usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphere
https://vuldb.com/vuln/377848
Signature, Permissions Required signature permissions-required
VDB-377848 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/377848/cti
Third Party Advisory third-party-advisory
CVE-2026-15519 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15519
Third Party Advisory third-party-advisory
Submit #850802 | usestrix strix <= 1.0.2 rce
https://vuldb.com/submit/850802

Scores

CVSS v3 5.0
EPSS 0.0024
EPSS Percentile 15.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-829
Status published
Products (3)
usestrix/strix 1.0.0
usestrix/strix 1.0.1
usestrix/strix 1.0.2
Published Jul 13, 2026
Tracked Since Jul 13, 2026