CVE record

CVE-2016-10745

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

Known exploitation

Not listed in fetched KEV catalog

Absence from the fetched catalog does not establish that exploitation has not occurred.

Severity

high

CVSS 8.6 · CVSS_V3

Affected packages

Supported package records returned by OSV. Vendor and product names are not used to infer matches.

OSV package mapping

Affected open-source packages

Package	Ecosystem	Fixed versions
jinja2	pypi	2.8.1, 9b53045c34e61013dc8f09b7e52a555fa16bed16