CVE-2024-56201
published 2024-12-23CVE-2024-56201: Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the…
PriorityP349high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.31%
22.9th percentile
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jinja2 | < jinja2 3.1.2-1+deb12u2 (bookworm) | jinja2 3.1.2-1+deb12u2 (bookworm) |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-jinja2_3.1.2-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-jinja2_3.1.2-3_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python-jinja2_3.0.3-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-jinja2_3.0.3-7_on_cbl_mariner_2.0 | — | — |
| pallets | jinja | — | — |
| palletsprojects | jinja | >= 3.0.0 < 3.1.5 | 3.1.5 |
| pocoo | jinja2 | >= 0 < 3.1.2-1+deb12u2 | 3.1.2-1+deb12u2 |
| pocoo | jinja2 | >= 0 < 3.1.5-1 | 3.1.5-1 |
| pocoo | jinja2 | >= 0 < 3.1.5-1 | 3.1.5-1 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.5 | 2.10.1-2ubuntu0.5 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.4 | 2.10.1-2ubuntu0.4 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.6 | 2.10.1-2ubuntu0.6 |
| pocoo | jinja2 | >= 0 < 3.0.3-1ubuntu0.4 | 3.0.3-1ubuntu0.4 |
| pocoo | jinja2 | >= 0 < 3.0.3-1ubuntu0.3 | 3.0.3-1ubuntu0.3 |
| pocoo | jinja2 | >= 0 < 3.1.2-1ubuntu1.3 | 3.1.2-1ubuntu1.3 |
| pocoo | jinja2 | >= 0 < 3.1.2-1ubuntu1.2 | 3.1.2-1ubuntu1.2 |
| pocoo | jinja2 | >= 0 < 2.7.2-2ubuntu0.1~esm6 | 2.7.2-2ubuntu0.1~esm6 |
| pocoo | jinja2 | >= 0 < 2.8-1ubuntu0.1+esm5 | 2.8-1ubuntu0.1+esm5 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1+esm4 | 2.10-1ubuntu0.18.04.1+esm4 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1+esm3 | 2.10-1ubuntu0.18.04.1+esm3 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1+esm5 | 2.10-1ubuntu0.18.04.1+esm5 |
| pocoo | jinja2 | >= 3.0.0 < 3.1.5 | 3.1.5 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.05.4MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.4MEDIUM
vendor_msrc8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Jinja2 regression
vendor_ubuntu·2025-03-12·CVSS 8.8
[HIGH] Jinja2 regression
Title: Jinja2 regression
Summary: USN-7343-1 introduced a regression in Jinja2.
USN-7343-1 fixed vulnerabilities in Jinja2. The update introduced a
regression when attempting to import Jinja2 on Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format me
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2025-03-11·CVSS 8.8
CVE-2025-27516 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in Jinja2.
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format method. An attacker could possibly use
this issue to enable the execution of arbitrary code. This issue only
affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-56326)
It was discovered that Jinja2 sandboxed environments could be escaped
thr
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2025-01-30·CVSS 8.8
CVE-2024-56201 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in jinja2.
It was discovered that Jinja2 incorrectly handled certain filenames when
compiling template content. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2024-56201)
It was discovered that Jinja2 incorrectly handled string formatting calls.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-56326)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
jinja2: Jinja has a sandbox breakout through malicious filenames
vendor_redhat·2024-12-23·CVSS 5.4
CVE-2024-56201 [MEDIUM] CWE-150 jinja2: Jinja has a sandbox breakout through malicious filenames
jinja2: Jinja has a sandbox breakout through malicious filenames
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that cont
Microsoft
Jinja has a sandbox breakout through malicious filenames
vendor_msrc·2024-12-10·CVSS 8.8
CVE-2024-56201 [MEDIUM] CWE-150 Jinja has a sandbox breakout through malicious filenames
Jinja has a sandbox breakout through malicious filenames
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:
Debian
CVE-2024-56201: jinja2 - Jinja is an extensible templating engine. In versions on the 3.x branch prior to...
vendor_debian·2024·CVSS 5.4
CVE-2024-56201 [MEDIUM] CVE-2024-56201: jinja2 - Jinja is an extensible templating engine. In versions on the 3.x branch prior to...
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
Scope: local
bookworm: resolved (fixed in 3.1.2-1+deb12u2)
bullseye: resolved
forky: resolved (fixed in 3.1.5-1)
sid: resolved (fixed in 3.1.5-1)
trixie: resolved
OSV
jinja2 regression
osv·2025-03-12·CVSS 5.4
[MEDIUM] jinja2 regression
jinja2 regression
USN-7343-1 fixed vulnerabilities in Jinja2. The update introduced a
regression when attempting to import Jinja2 on Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format method. An attacker could possibly use
this issue to enable the e
OSV
jinja2 vulnerabilities
osv·2025-03-11·CVSS 5.4
CVE-2024-56201 [MEDIUM] jinja2 vulnerabilities
jinja2 vulnerabilities
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format method. An attacker could possibly use
this issue to enable the execution of arbitrary code. This issue only
affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-56326)
It was discovered that Jinja2 sandboxed environments could be escaped
through the malicious use of certain filters. An attacker could po
OSV
jinja2 vulnerabilities
osv·2025-01-30·CVSS 5.4
CVE-2024-56201 [MEDIUM] jinja2 vulnerabilities
jinja2 vulnerabilities
It was discovered that Jinja2 incorrectly handled certain filenames when
compiling template content. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2024-56201)
It was discovered that Jinja2 incorrectly handled string formatting calls.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-56326)
OSV
CVE-2024-56201: Jinja is an extensible templating engine
osv·2024-12-23·CVSS 5.4
CVE-2024-56201 [MEDIUM] CVE-2024-56201: Jinja is an extensible templating engine
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
GHSA
Jinja has a sandbox breakout through malicious filenames
ghsa·2024-12-23
CVE-2024-56201 [MEDIUM] CWE-150 Jinja has a sandbox breakout through malicious filenames
Jinja has a sandbox breakout through malicious filenames
A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.
To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.
OSV
Jinja has a sandbox breakout through malicious filenames
osv·2024-12-23
CVE-2024-56201 [MEDIUM] Jinja has a sandbox breakout through malicious filenames
Jinja has a sandbox breakout through malicious filenames
A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.
To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-56201 python-jinja2-time: Jinja has a sandbox breakout through malicious filenames [epel-8]
bugzilla·2025-01-08·CVSS 5.4
CVE-2024-56201 [MEDIUM] CVE-2024-56201 python-jinja2-time: Jinja has a sandbox breakout through malicious filenames [epel-8]
CVE-2024-56201 python-jinja2-time: Jinja has a sandbox breakout through malicious filenames [epel-8]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2333854
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
How is python-jinja2-time affected by this?
---
I as well believe python-jinja2-time is affected by this (as it just adds a tag on top)
---
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days or the product is inactive and locked
Bugzilla
CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames
bugzilla·2024-12-23·CVSS 5.4
CVE-2024-56201 [MEDIUM] CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames
CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames
Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
Discussion:
This project is not affected as it does not bundle the source code of jinja2.
---
(In reply to f
2024-12-23
Published