Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

🗓️ 07 Jul 2026 11:45:41Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

Jinja xmlattr filter allows HTML attribute injection via user keys, enabling XSS; values stay safe.

Reporter	Title	Published	Views	Family All 273
ibm	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
ibm	Security Bulletin: Vulnerability in jinja2 affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-34064]	22 Jun 202513:35	–	ibm
ibm	Security Bulletin: Vulnerabilities in Linux Kernel, MongoDB, Python, Samba, OpenSSL and cURL libcurl affect IBM Spectrum Protect Plus	10 Apr 202507:49	–	ibm
ibm	Security Bulletin: Vulnerability in Jinja2 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-34064].	8 May 202511:00	–	ibm
ibm	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
ibm	Security Bulletin: IBM Cloud Pak for Data is vulnerable to cross-site scripting due to Jinja2 ( CVE-2024-34064 )	8 Aug 202418:26	–	ibm
ibm	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	18 Sep 202410:14	–	ibm
ibm	Security Bulletin: IBM Truststore Manager uses Jinja2-3.1.3-py3-none-any.whl which is vulnerable to CVE-2024-34064	19 Sep 202415:47	–	ibm
ibm	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	7 Mar 202516:09	–	ibm
ibm	Security Bulletin: Denial of service and security restrictions bypass might affect IBM Storage Defender – Resiliency Service	3 Jul 202420:06	–	ibm

Vulners

Node

pypi jinja2Range0–3.1.4

Source	Link
github	www.github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-34064
github	www.github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb
github	www.github.com/pallets/jinja
lists	www.lists.debian.org/debian-lts-announce/2024/12/msg00009.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS
pypi	www.pypi.org/project/jinja2

07 Jul 2026 17:24Current

6Medium risk

Vulners AI Score6

CVSS 3.15.4

EPSS0.00979

SSVC