214 matches found
python-jinja2: Sandbox escape due to information disclosure via str.format
A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...
PT-2019-5137
Name of the Vulnerable Software and Affected Versions Pallets Werkzeug versions prior to 0.15.3 Description The issue is related to insufficient entropy in the PIN selection of the generate function in the Werkzeug web application library. This can allow a remote attacker to gain unauthorized...
python-jinja2: Sandbox escape due to information disclosure via str.format
A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...
GHSA-462W-V97R-4M45 Jinja2 sandbox escape via string formatting
In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.formatmap method could be used to escape the sandbox. This...
Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
GHSA-HJ2J-77XM-MC5V Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
Use of Externally-Controlled Format String
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
PYSEC-2019-220
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
Code injection
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
PYSEC-2019-220
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
CVE-2016-10745
CVE-2016-10745 affects Pallets Jinja2: in Pallets Jinja before 2.8.1, str.format allows a sandbox escape. Affected component is the Python Jinja2 library; root cause is sandbox escape via str.format parsing. Impact documented as sandbox escape (high risk per CVSS in references), with several advi...
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
PT-2019-7543
Name of the Vulnerable Software and Affected Versions Pallets Jinja versions prior to 2.8.1 Description The issue allows a sandbox escape through the str.format function. Recommendations For versions prior to 2.8.1, update to version 2.8.1 or later to resolve the issue...
