CVE-2024-22195

2024-01-1111:04:16

redhat.com

access.redhat.com

cve-2024-22195

cross-site scripting

jinja2

xml/html attribute standards

user-input keys

attribute validation checks

red hat product security

0.001 Low

EPSS

Percentile

40.9%

JSON

A cross-site scripting (XSS) flaw was found in Jinja2 due to the xmlattr filter allowing keys with spaces, contrary to XML/HTML attribute standards. If an application accepts user-input keys and renders them for other users, attackers can inject additional attributes, potentially leading to XSS. This misuse of the xmlattr filter enables the injection of arbitrary HTML attributes, bypassing auto-escaping and potentially circumventing attribute validation checks.

Mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.