Palletsprojects Jinja
8 CVEs affecting Palletsprojects Jinja. Latest disclosed: 2025-03-05. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27516 | High | 8.8 | 2025-03-05 | Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacke… |
CVE-2024-56201 | High | 8.8 | 2024-12-23 | Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the c… |
CVE-2016-10745 | High | 8.6 | 2019-04-08 | In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. |
CVE-2019-10906 | High | 8.6 | 2019-04-07 | In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. |
CVE-2024-56326 | High | 7.8 | 2024-12-23 | Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker th… |
CVE-2024-34064 | Medium | 5.4 | 2024-05-06 | Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attribu… |
CVE-2024-22195 | Medium | 5.4 | 2024-01-11 | Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary… |
CVE-2020-28493 | Medium | 5.3 | 2021-02-01 | This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of mult… |