CVE-2024-22195
published 2024-01-11CVE-2024-22195: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary…
PriorityP427medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.89%
55.7th percentile
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jinja2 | < jinja2 3.1.2-1+deb12u1 (bookworm) | jinja2 3.1.2-1+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-jinja2_3.1.2-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-jinja2_3.1.2-3_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nodejs18_18.20.3-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_nodejs18_18.20.3-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-jinja2_3.0.3-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-jinja2_3.0.3-7_on_cbl_mariner_2.0 | — | — |
| pallets | jinja | < 3.1.4 | 3.1.4 |
| palletsprojects | jinja | < 3.1.3 | 3.1.3 |
| palletsprojects | jinja | < 3.1.4 | 3.1.4 |
| pocoo | jinja2 | >= 0 < 2.11.3-1+deb11u1 | 2.11.3-1+deb11u1 |
| pocoo | jinja2 | >= 0 < 3.1.2-1+deb12u1 | 3.1.2-1+deb12u1 |
| pocoo | jinja2 | >= 0 < 3.1.3-1 | 3.1.3-1 |
| pocoo | jinja2 | >= 0 < 3.1.3-1.1 | 3.1.3-1.1 |
| pocoo | jinja2 | >= 0 < 3.1.3-1 | 3.1.3-1 |
| pocoo | jinja2 | >= 0 < 3.1.3-1.1 | 3.1.3-1.1 |
| pocoo | jinja2 | >= 0 < 3.1.4 | 3.1.4 |
| pocoo | jinja2 | >= 0 < 3.1.3 | 3.1.3 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.2 | 2.10.1-2ubuntu0.2 |
| pocoo | jinja2 | >= 0 < 3.0.3-1ubuntu0.1 | 3.0.3-1ubuntu0.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_msrc6.1MEDIUM
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
ghsa·2024-05-06·CVSS 6.1
CVE-2024-34064 [MEDIUM] CWE-79 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.
Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the in
OSV
CVE-2024-34064: Jinja is an extensible templating engine
osv·2024-05-06·CVSS 6.1
CVE-2024-34064 [MEDIUM] CVE-2024-34064: Jinja is an extensible templating engine
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as us
OSV
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
osv·2024-05-06·CVSS 6.1
CVE-2024-34064 [MEDIUM] Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.
Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the in
OSV
jinja2 vulnerabilities
osv·2024-01-25·CVSS 5.3
CVE-2020-28493 [MEDIUM] jinja2 vulnerabilities
jinja2 vulnerabilities
Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)
It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)
OSV
CVE-2024-22195: Jinja is an extensible templating engine
osv·2024-01-11·CVSS 6.1
CVE-2024-22195 [MEDIUM] CVE-2024-22195: Jinja is an extensible templating engine
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
OSV
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
osv·2024-01-11
CVE-2024-22195 [MEDIUM] Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.
GHSA
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
ghsa·2024-01-11
CVE-2024-22195 [MEDIUM] CWE-79 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.
Red Hat
jinja2: accepts keys containing non-attribute characters
vendor_redhat·2024-05-06·CVSS 5.4
CVE-2024-34064 [MEDIUM] CWE-79 jinja2: accepts keys containing non-attribute characters
jinja2: accepts keys containing non-attribute characters
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insec
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2024-01-25·CVSS 5.3
CVE-2020-28493 [MEDIUM] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in jinja2.
Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)
It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
vendor_redhat·2024-01-11·CVSS 5.4
CVE-2024-22195 [MEDIUM] CWE-79 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
A cross-site scripting (XSS) flaw was found in Jinja2 due to the xmlattr filter allowing keys with spaces, contrary to XML/HTML attribute standards. If an application accepts user-input keys and renders
Microsoft
Jinja vulnerable to Cross-Site Scripting (XSS)
vendor_msrc·2024-01-09·CVSS 6.1
CVE-2024-22195 [MEDIUM] CWE-79 Jinja vulnerable to Cross-Site Scripting (XSS)
Jinja vulnerable to Cross-Site Scripting (XSS)
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.mi
Debian
CVE-2024-22195: jinja2 - Jinja is an extensible templating engine. Special placeholders in the template a...
vendor_debian·2024·CVSS 5.4
CVE-2024-22195 [MEDIUM] CVE-2024-22195: jinja2 - Jinja is an extensible templating engine. Special placeholders in the template a...
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
Scope: local
bookworm: resolved (fixed in 3.1.2-1+deb12u1)
bullseye: resolved (fixed in 2.11.3-1+deb11u1)
forky: resolved (fixed in 3.1.3-1)
sid: resolved (fixed in 3.1.3-1)
trixie: resolved (fixed in 3.1.3-1)
Debian
CVE-2024-34064: jinja2 - Jinja is an extensible templating engine. The `xmlattr` filter in affected versi...
vendor_debian·2024·CVSS 5.4
CVE-2024-34064 [MEDIUM] CVE-2024-34064: jinja2 - Jinja is an extensible templating engine. The `xmlattr` filter in affected versi...
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as us
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
bugzilla·2024-05-07·CVSS 6.1
CVE-2024-34064 [MEDIUM] CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be f
Bugzilla
CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
bugzilla·2024-01-11·CVSS 6.1
CVE-2024-22195 [MEDIUM] CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
https://github.com/pallets/jinja/releases/tag/3.1.3
https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95
Discussion:
Upstream Commit: https://github.com/pallets/jinj
https://github.com/pallets/jinja/releases/tag/3.1.3https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95https://lists.debian.org/debian-lts-announce/2024/01/msg00010.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/https://lists.fedoraproject.org/archives/list/[email protected]/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/https://lists.fedoraproject.org/archives/list/[email protected]/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/https://github.com/pallets/jinja/releases/tag/3.1.3https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95https://lists.debian.org/debian-lts-announce/2024/01/msg00010.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00009.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/https://lists.fedoraproject.org/archives/list/[email protected]/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/https://lists.fedoraproject.org/archives/list/[email protected]/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/
2024-01-11
Published