Prompt injection flaw reported in Meta's Open GenAI Stack

A vulnerability disclosed on 29 September 2026 says that Open GenAI Stack, also known as ogx-ai, allows code execution through prompt injection. The entry in the US National Vulnerability Database, catalogued as CVE-2026-77177, states that the affected software is used in the Meta AI backend for WhatsApp and other products.

According to the NVD record, the flaw is present in the 11 June 2026 version of Open GenAI Stack. The problem is that prompt injection using Jinja2 template syntax — a way of writing placeholders that a program fills in when it builds text — can be used to achieve server-side expression evaluation without sanitisation. In plain terms, text that is supposed to be treated as data can instead be treated as instructions that the server runs.

Prompt injection is the term for getting a model or the software around it to act on attacker-supplied text. In most reported cases the consequence is unwanted model output. The distinguishing feature described in this record is that the injected text reaches a template engine that evaluates expressions on the server, which is why the NVD entry describes the outcome as code execution rather than simply unwanted responses.

The NVD entry lists a single reference, a public gist, as the source of the report. It does not describe the conditions required to trigger the issue, whether the problem has been fixed, or whether any systems were affected in practice. No patched version is named in the record. The database entry does not state who discovered the flaw beyond the reference it links to, and The Agentic Times is not naming the reporter.

Meta is named in the NVD description as the operator of the backend in which the software is used. The record does not include a statement from the company, and no vendor advisory is listed alongside the entry. The status of the report, as recorded, is that it has been reported rather than confirmed as resolved.

For teams running similar architectures, the pattern in the description is the part worth noting. Template engines are commonly used to assemble prompts from fixed text and variable inputs. If user-controlled content is inserted into a template before the template is rendered, rather than after, the engine may evaluate whatever syntax the user supplied. The NVD description attributes the flaw to the absence of sanitisation at that point.

No severity score is included in the published NVD entry at the time of writing, and no exploitation in the wild is described in the record.