Fluid Attacks Database

Description

Jinja2 sandbox escape vulnerability In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	jinja2	>=0 <2.8.1	2.8.1
debian 11	jinja2	>=0 <2.9.4-1	2.9.4-1
debian 13	jinja2	>=0 <2.9.4-1	2.9.4-1
debian 14	jinja2	>=0 <2.9.4-1	2.9.4-1
debian 12	jinja2	>=0 <2.9.4-1	2.9.4-1
rpm rhel7	python-jinja2	<0:2.7.2-3.el7_6	0:2.7.2-3.el7_6
rpm rhel6	python-jinja2	-	-
rpm rhel7.5	python-jinja2	<0:2.7.2-3.el7_5	0:2.7.2-3.el7_5

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.