AIKIDO-2026-711956

TL;DR

Haystack loads pipeline definitions in a default safe mode that is meant to reject dangerous callables while deserializing components. A crafted pipeline can bypass this by setting an unsafe flag on OutputAdapter or ConditionalRouter to disable the Jinja sandbox, or by registering an import primitive such as thread_safe_import as a Jinja custom filter that Jinja invokes during template compilation. It can also traverse allowlisted modules during callable resolution to reach dangerous callables and disarm the deserialization allowlist. Loading an untrusted pipeline therefore leads to arbitrary command execution; the fix blocks import primitives, rejects serialized unsafe flags in safe mode, hardens the Jinja sandbox, and validates the real module of every object during callable traversal.