CVE-2025-27516

CVE-2025-27516 : Jinja2 before 3.1.6 exposes a sandbox bypass via the |attr filter, allowing arbitrary Python code execution if an attacker controls template content. Affected: jinja2 versions prior to 3.1.6. Impact: execution of code in untrusted templates. Remediation: upgrade to 3.1.6 or newer...

CVE-2024-56326

The Jinja templating engine (prior to version 3.1.5 ) is vulnerable to arbitrary Python code execution due to an oversight in how the sandboxed environment detects calls to str.format . An attacker who controls the content of a template can store a reference to a malicious string's format method ...

CVE-2024-22195

CVE-2024-22195 affects Jinja2: the xmlattr filter can accept keys/values that bypass escaping, enabling possible XSS via HTML attribute injection. Public notes show affected packages including python-jinja2 and jinja2, with fixes in 3.1.4 (e.g., Astra Linux entry indicates 3.1.4 as the patch). De...

CVE-2019-10906

CVE-2019-10906 affects Pallets Jinja2 before 2.10.1. The vulnerability arises from str.format_map allowing a sandbox escape, enabling potentially untrusted template code to escape sandbox restrictions. The issue is blocked to Jinja2’s sandboxed evaluation and affects environments using Pallets Ji...

CVE-2020-28493

CVE-2020-28493 affects jinja2 up to version 2.11.3 (inclusive of 0.0.0 to before 2.11.3). The root cause is a Denial of Service likely caused by the regex in the _punctuation_re used by the urlize filter, leading to excessive CPU on crafted input. Public documents identify this ReDoS vulnerabilit...

CVE-2024-34064

The CVE-2024-34064 issue affects Jinja2’s xmlattr filter, where keys containing non-attribute characters (e.g., spaces, /, >, =) can be rendered into HTML attributes, potentially enabling attribute-injection-based XSS when applications render user-supplied keys. The vulnerability arises if an ...

CVE-2016-10745

CVE-2016-10745 affects Pallets Jinja2: in Pallets Jinja before 2.8.1, str.format allows a sandbox escape. Affected component is the Python Jinja2 library; root cause is sandbox escape via str.format parsing. Impact documented as sandbox escape (high risk per CVSS in references), with several advi...