In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Priority MEDIUM 44CWE-693Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.
Summary
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Why it matters now
EPSS 0.03603 89th percentileScored 2026-11-07
Fix Fixed Jinja2 (PyPI): 2.10.1Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Jinja2 (PyPI) | before 2.10.1 | 2.10.1 | Patch available | GHSA-462w-v97r-4m45 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Jinja2 (PyPI) Vendor— Affected before 2.10.1 Fixed in 2.10.1 Patch available GHSA-462w-v97r-4m45
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:* | before 2.10.1 | Vulnerable | pallets |
| cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* | 28 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
- cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:* Versions before 2.10.1 Vulnerable ·pallets
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
Remediation
- Fix · GHSA-462w-v97r-4m45 Jinja2 (PyPI) Fixed in 2.10.1 Advisory →
Red Hat 4 advisories
- RHSA-2019:3172 Released 2019-10-22 · Red Hat rating ModerateRed Hat Satellite 6 security, bug fix, and enhancement update
- Red Hat Satellite 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
- Red Hat Satellite Capsule 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
- RHSA-2019:1329 Released 2019-06-04 · Red Hat rating Importantrh-python36-python-jinja2 security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-python36-python-jinja2-2.9.6-3.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python36-python-jinja2-2.9.6-3.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-python36-python-jinja2-2.9.6-3.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-python36-python-jinja2-2.9.6-3.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python36-python-jinja2-2.9.6-3.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-python36-python-jinja2-2.9.6-3.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python36-python-jinja2-2.9.6-3.el7
- RHSA-2019:1237 Released 2019-05-16 · Red Hat rating Importantrh-python35-python-jinja2 security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-python35-python-jinja2-2.8.1-2.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python35-python-jinja2-2.8.1-2.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-python35-python-jinja2-2.8.1-2.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-python35-python-jinja2-2.8.1-2.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python35-python-jinja2-2.8.1-2.el7
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-python35-python-jinja2-2.8.1-2.el6
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python35-python-jinja2-2.8.1-2.el7
Show 1 more Red Hat advisories
- RHSA-2019:1152 Released 2019-05-13 · Red Hat rating Importantpython-jinja2 security update
- Red Hat Enterprise Linux AppStream (v. 8) python-jinja2-2.10.1-2.el8_0, python3-jinja2-2.10.1-2.el8_0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:1152 |
| Red Hat Satellite 6.6 | Fixed | RHSA-2019:3172 |
| Red Hat Satellite Capsule 6.6 | Fixed | RHSA-2019:3172 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:1237, RHSA-2019:1329 |
Not affected: 12 products
- Red Hat Ceph Storage 2
- Red Hat Ceph Storage 3
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 14 (Rocky)
- Red Hat OpenStack Platform 15 (Stein)
- Red Hat Software Collections
- Red Hat Storage 3
- Red Hat Update Infrastructure 3 for Cloud Providers
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10906
- 2026-10-03 Alias added: GHSA-462w-v97r-4m45
References
Advisory 13
- https://palletsprojects.com/blog/jinja-2-10-1-released
- FEDORA-2019-4f978cacb4
- FEDORA-2019-e41e19457b
- FEDORA-2019-04a42e480b
- RHSA-2019:1152
- openSUSE-SU-2019:1395
- RHSA-2019:1237
- RHSA-2019:1329
- USN-4011-1
- USN-4011-2
- openSUSE-SU-2019:1614
- https://nvd.nist.gov/vuln/detail/CVE-2019-10906
- https://github.com/advisories/GHSA-462w-v97r-4m45
Other 23
- [infra-devnull] 20190410 [GitHub] [airflow] XD-DENG opened pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [airflow-commits] 20190410 [GitHub] [airflow] XD-DENG opened a new pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [airflow-commits] 20190410 [GitHub] [airflow] XD-DENG commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [airflow-commits] 20190410 [GitHub] [airflow] ashb commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [infra-devnull] 20190410 [GitHub] [airflow] XD-DENG commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [infra-devnull] 20190410 [GitHub] [airflow] ashb commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [airflow-commits] 20190410 [GitHub] [airflow] ashb merged pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- [infra-devnull] 20190410 [GitHub] [airflow] ashb closed pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906
- https://usn.ubuntu.com/4011-2
- https://usn.ubuntu.com/4011-1
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF
- https://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02@%3Ccommits.airflow.apache.org%3E
- https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284@%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df@%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac@%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f@%3Cdevnull.infra.apache.org%3E
- https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2019-217.yaml
- https://github.com/pallets/jinja
Sources
- CVE-2019-10906 · CVE Program
- CVE-2019-10906 · NVD
- FIRST EPSS
- GHSA-462w-v97r-4m45 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10906 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences