Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

jinja2

10 known vulnerabilities (6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 6 medium
Registry
PyPI

Advisories 10

  • CVE-2025-27516Medium 5.4

    Jinja sandbox breakout through attr filter selecting format method

    Affected: fixed in 3.1.6.

  • CVE-2024-56326Medium 5.4

    Jinja has a sandbox breakout through indirect reference to format method

    Affected: fixed in 3.1.5.

  • CVE-2024-56201Medium 5.4

    Jinja has a sandbox breakout through malicious filenames

    Affected: from 3.0.0, fixed in 3.1.5.

  • CVE-2024-34064Medium 5.4

    Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

    Affected: fixed in 3.1.4.

  • CVE-2024-22195Medium 5.4

    Jinja vulnerable to Cross-Site Scripting (XSS)

    Affected: fixed in 3.1.3.

  • CVE-2020-28493Medium 5.3

    Regular Expression Denial of Service (ReDoS)

    Affected: fixed in 2.11.3; fixed in 2.11.3.

  • In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

    Affected: fixed in 2.8.1.

  • In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

    Affected: fixed in 2.10.1.

  • The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which…

    Affected: fixed in 2.7.2.

  • FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by…

    Affected: fixed in 2.7.3; fixed in 2.7.2.