Vulnerabilities

TI-2025-20348 CVE-2025-27516 · GHSA-cpwx-vrp4-4pq7

Jinja sandbox breakout through attr filter selecting format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00507 Published 2025-03-05 Partial fix · 3.1.6 CWE-1336

TI-2024-37287 CVE-2024-56326 · GHSA-q2x7-8rv6-6q7h

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00522 Published 2024-12-23 Partial fix · 3.1.5 CWE-1336

TI-2024-37171 CVE-2024-56201 · GHSA-gmj6-6f8f-6699

LOW 26

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00307 Published 2024-12-23 Partial fix · 3.1.5 CWE-150

TI-2024-22522 CVE-2024-34064 · GHSA-h75v-3vvj-5mfj

LOW 26

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00979 Published 2024-05-06 Partial fix · 3.1.4 CWE-79

TI-2024-14788 CVE-2024-22195 · GHSA-h5c8-rqwp-cp95

LOW 29

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00892 Published 2024-01-11 Partial fix · 3.1.3 CWE-79

TI-2020-17297 CVE-2020-28493 · GHSA-g3rq-g295-4j3m

LOW 30

This affects the package jinja2 from 0.0.0 and before 2.11.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03589 Published 2021-02-01 Partial fix · 2.11.3 CWE-400

TI-2016-08785 CVE-2016-10745 · GHSA-hj2j-77xm-mc5v

MEDIUM 43

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.0352 Published 2019-04-08 Partial fix · 2.8.1 CWE-134

TI-2019-08127 CVE-2019-10906 · GHSA-462w-v97r-4m45

MEDIUM 44

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.03603 Published 2019-04-06 Fixed in 2.10.1 CWE-693