# Code execution through server-side-template-injection[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-004.html#code-execution-through-server-side-template-injection "Permalink to this headline")

## Information[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-004.html#information "Permalink to this headline")

* Advisory ID: DSA-2022-004

* CVSS String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

* CVSS Base Score: 8.8 (High)

* CWE classification: CWE-1336

## Summary[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-004.html#summary "Permalink to this headline")

In Dataiku DSS before 10.0.6, insufficient sanitization of custom email templates could allow an authenticated attacker to perform code execution.

## Affected Products[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-004.html#affected-products "Permalink to this headline")

* Dataiku DSS before 10.0.6

## Fix[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-004.html#fix "Permalink to this headline")

Dataiku DSS 10.0.6 has been made available to customers to remediate this issue
