Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nbWo2LTZmOGYtNjY5Oc4ABCrO

Jinja has a sandbox breakout through malicious filenames

A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.

To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.

Permalink: https://github.com/advisories/GHSA-gmj6-6f8f-6699
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nbWo2LTZmOGYtNjY5Oc4ABCrO
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 16 days ago
Updated: about 12 hours ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00045
EPSS Percentile: 0.17541

Identifiers: GHSA-gmj6-6f8f-6699, CVE-2024-56201
References:

• https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699
• https://github.com/pallets/jinja/releases/tag/3.1.5
• https://nvd.nist.gov/vuln/detail/CVE-2024-56201
• https://github.com/pallets/jinja/issues/1792
• https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f
• https://github.com/advisories/GHSA-gmj6-6f8f-6699

Repository: https://github.com/pallets/jinja
Blast Radius: 45.1

Affected Packages