pallets

Records29All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

pallets records in CISA KEV

No pallets vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Werkzeug 14 records HIGH Jinja 8 records MEDIUM Flask 4 records LOW Click 1 record HIGH Quart 1 record LOW

Records

8 records in Jinja · all components

TI-2019-08127 CVE-2019-10906 · GHSA-462w-v97r-4m45

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

MEDIUM 44

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.03603 Published 2019-04-06 Fixed in 2.10.1 CWE-693

TI-2016-08785 CVE-2016-10745 · GHSA-hj2j-77xm-mc5v

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

MEDIUM 43

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.0352 Published 2019-04-08 Partial fix · 2.8.1 CWE-134

TI-2020-17297 CVE-2020-28493 · GHSA-g3rq-g295-4j3m

Regular expression denial of service (ReDoS) in jinja2

LOW 30

This affects the package jinja2 from 0.0.0 and before 2.11.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03589 Published 2021-02-01 Partial fix · 2.11.3 CWE-400

TI-2024-14788 CVE-2024-22195 · GHSA-h5c8-rqwp-cp95

Jinja vulnerable to Cross-Site Scripting (XSS)

LOW 29

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00892 Published 2024-01-11 Partial fix · 3.1.3 CWE-79

TI-2025-20348 CVE-2025-27516 · GHSA-cpwx-vrp4-4pq7

Jinja sandbox breakout through attr filter selecting format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00507 Published 2025-03-05 Partial fix · 3.1.6 CWE-1336

TI-2024-37287 CVE-2024-56326 · GHSA-q2x7-8rv6-6q7h

Jinja has a sandbox breakout through indirect reference to format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00522 Published 2024-12-23 Partial fix · 3.1.5 CWE-1336

TI-2024-37171 CVE-2024-56201 · GHSA-gmj6-6f8f-6699

Jinja has a sandbox breakout through malicious filenames

LOW 26

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00307 Published 2024-12-23 Partial fix · 3.1.5 CWE-150

TI-2024-22522 CVE-2024-34064 · GHSA-h75v-3vvj-5mfj

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

LOW 26

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00979 Published 2024-05-06 Partial fix · 3.1.4 CWE-79

Open these records in search →