Arbitrary Code Execution

🗓️ 30 Dec 2024 08:22:48Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 12 Views

Jinja faces Arbitrary Code Execution vulnerability due to improper compiler handling, enabling code execution.

Reporter	Title	Published	Views	Family All 236
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	13 Mar 202616:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	16 Apr 202514:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to multiple Operator package issues	1 May 202521:38	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion HCI and IBM Fusion HCI for watsonx	31 May 202514:07	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses multiple vulnerable libraries and wildcard characters when defining RBAC permissions in Dockerfiles which are vulnerable to multiple CVEs	6 May 202506:26	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in the wheel package for Jinja2 affecting watsonx Code Assistant On Prem Extensions	27 Mar 202515:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to an arbitrary code execution in Jinja [CVE-2024-56201]	1 May 202517:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Jinja , cryptography & OpenSSL can affect IBM Storage Protect Plus File Systems Agent Backup and Restore	21 Jun 202508:35	–	ibm
IBM Security Bulletins	Security Bulletin: Jinja Template Sandbox Escape via Indirect str.format Execution Prior to 3.1.5	26 Jun 202518:51	–	ibm

Vulners

Node

py3-jinja2 py3-jinja2Match3.1.3-r1python

AND

py3-jinja2 py3-jinja2Match3.0.1-r0python

AND

py3-jinja2 py3-jinja2Match3.0.3-r1python

AND

py3-jinja2 py3-jinja2Match3.0.0-r0python

AND

py3-jinja2 py3-jinja2Match2.11.3-r1python

AND

py3-jinja2 py3-jinja2Match3.0.1-r1python

AND

py3-jinja2 py3-jinja2Match2.11.1-r0python

AND

py3-jinja2 py3-jinja2Match3.1.4-r0python

AND

py3-jinja2 py3-jinja2Match3.1.2-r3python

AND

py3-jinja2 py3-jinja2Match2.11.2-r0python

AND

py3-jinja2 py3-jinja2Match3.1.2-r0python

AND

py3-jinja2 py3-jinja2Match2.11.3-r0python

AND

py3-jinja2 py3-jinja2Match3.1.3-r0python

AND

py3-jinja2 py3-jinja2Match3.1.2-r2python

AND

py3-jinja2 py3-jinja2Match3.1.2-r1python

AND

py3-jinja2 py3-jinja2Match3.0.3-r0python

AND

alpinelinux alpine_linuxMatchedge

py3-jinja2 py3-jinja2Match3.1.3-r1python

AND

py3-jinja2 py3-jinja2Match3.1.4-r0python

AND

alpinelinux alpine_linuxMatch3.20

py3-jinja2 py3-jinja2Match3.1.4-r0python

AND

py3-jinja2 py3-jinja2Match3.1.2-r3python

AND

alpinelinux alpine_linuxMatch3.19

py3-jinja2 py3-jinja2Match3.1.4-r0python

AND

py3-jinja2 py3-jinja2Match3.1.2-r2python

AND

alpinelinux alpine_linuxMatch3.18

py3-jinja2 py3-jinja2Match3.1.4-r0python

AND

alpinelinux alpine_linuxMatch3.21

pocoo jinja2Range2.0rc1–3.1.4python

pocoo jinja2Match3.0.0python

pocoo jinja2Match3.0.1python

pocoo jinja2Match3.0.2python

pocoo jinja2Match3.0.3python

pocoo jinja2Match3.1.0python

pocoo jinja2Match3.1.1python

pocoo jinja2Match3.1.2python

pocoo jinja2Match3.1.3python

Source	Link
github	www.github.com/pallets/jinja/issues/1792
github	www.github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f
github	www.github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699
github	www.github.com/pallets/jinja/releases/tag/3.1.5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-56201
github	www.github.com/pallets/jinja

13 Dec 2025 07:33Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.8

CVSS 45.4

EPSS0.00573

SSVC