GHSA-gmj6-6f8f-6699 high
Jinja has a sandbox breakout through malicious filenames
Affected range
ECOSYSTEM: introduced 3.0.0; fixed 3.1.5Fixed versions: 3.1.5
Jinja2
A very fast and expressive template engine.
PyPI latest 3.1.6
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
3.1.6
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
10 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-q2x7-8rv6-6q7h high
Jinja has a sandbox breakout through indirect reference to format method
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.5Fixed versions: 3.1.5
GHSA-hj2j-77xm-mc5v high
Jinja2 sandbox escape vulnerability
Affected range
ECOSYSTEM: introduced 0; fixed 2.8.1GIT: introduced 0; fixed 9b53045c34e61013dc8f09b7e52a555fa16bed16Fixed versions: 2.8.1, 9b53045c34e61013dc8f09b7e52a555fa16bed16
GHSA-462w-v97r-4m45 high
Jinja2 sandbox escape via string formatting
Affected range
ECOSYSTEM: introduced 0; fixed 2.10.1Fixed versions: 2.10.1
GHSA-8r7q-cvjq-x353 high
Incorrect Privilege Assignment in Jinja2
Affected range
ECOSYSTEM: introduced 0; fixed 2.7.2Fixed versions: 2.7.2
GHSA-h75v-3vvj-5mfj moderate
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.4Fixed versions: 3.1.4
GHSA-h5c8-rqwp-cp95 moderate
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.3Fixed versions: 3.1.3
GHSA-cpwx-vrp4-4pq7 moderate
Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
Affected range
ECOSYSTEM: introduced 0; fixed 3.1.6Fixed versions: 3.1.6
GHSA-g3rq-g295-4j3m moderate
Regular Expression Denial of Service (ReDoS) in Jinja2
Affected range
ECOSYSTEM: introduced 0; fixed 2.11.3Fixed versions: 2.11.3
GHSA-fqh9-2qgg-h84h moderate
Insecure Temporary File in Jinja2
Affected range
ECOSYSTEM: introduced 0; fixed 2.7.2GIT: introduced 0; fixed acb672b6a179567632e032f547582f30fa2f4aa7ECOSYSTEM: introduced 0; fixed 2.7.3Fixed versions: 2.7.2, acb672b6a179567632e032f547582f30fa2f4aa7, 2.7.3