Vulnerabilities for Jinja2

First version without a known vulnerability: 3.1.6

Details

• GHSA-cpwx-vrp4-4pq72025-03-05

  Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

  Fixed in: 3.1.6

• GHSA-q2x7-8rv6-6q7h2024-12-23

  Jinja has a sandbox breakout through indirect reference to format method

  Fixed in: 3.1.5

• GHSA-gmj6-6f8f-66992024-12-23

  Jinja has a sandbox breakout through malicious filenames

  Fixed in: 3.1.5

• GHSA-h75v-3vvj-5mfj2024-05-06

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Fixed in: 3.1.4

• GHSA-h5c8-rqwp-cp952024-01-11

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Fixed in: 3.1.3

• GHSA-fqh9-2qgg-h84h2022-05-17

  Insecure Temporary File in Jinja2

  Fixed in: 2.7.2, acb672b6a179567632e032f547582f30fa2f4aa7, 2.7.3

• GHSA-8r7q-cvjq-x3532022-05-14

  Incorrect Privilege Assignment in Jinja2

  Fixed in: 2.7.2

• GHSA-g3rq-g295-4j3m2021-03-19

  Regular Expression Denial of Service (ReDoS) in Jinja2

  Fixed in: 2.11.3

• GHSA-462w-v97r-4m452019-04-10

  Jinja2 sandbox escape via string formatting

  Fixed in: 2.10.1

• GHSA-hj2j-77xm-mc5v2019-04-10

  Jinja2 sandbox escape vulnerability

  Fixed in: 2.8.1, 9b53045c34e61013dc8f09b7e52a555fa16bed16