CVE-2024-56326
published 2024-12-23CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker…
PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.52%
41.1th percentile
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jinja2 | < jinja2 3.1.2-1+deb12u2 (bookworm) | jinja2 3.1.2-1+deb12u2 (bookworm) |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-jinja2_3.1.2-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-jinja2_3.1.2-3_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nodejs18_18.20.3-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-jinja2_3.0.3-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-jinja2_3.0.3-7_on_cbl_mariner_2.0 | — | — |
| pallets | jinja | < 3.1.5 | 3.1.5 |
| palletsprojects | jinja | < 3.1.5 | 3.1.5 |
| pocoo | jinja2 | >= 0 < 2.11.3-1+deb11u3 | 2.11.3-1+deb11u3 |
| pocoo | jinja2 | >= 0 < 3.1.2-1+deb12u2 | 3.1.2-1+deb12u2 |
| pocoo | jinja2 | >= 0 < 3.1.5-1 | 3.1.5-1 |
| pocoo | jinja2 | >= 0 < 3.1.5-1 | 3.1.5-1 |
| pocoo | jinja2 | >= 0 < 3.1.5 | 3.1.5 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.5 | 2.10.1-2ubuntu0.5 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.4 | 2.10.1-2ubuntu0.4 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.6 | 2.10.1-2ubuntu0.6 |
| pocoo | jinja2 | >= 0 < 3.0.3-1ubuntu0.4 | 3.0.3-1ubuntu0.4 |
| pocoo | jinja2 | >= 0 < 3.0.3-1ubuntu0.3 | 3.0.3-1ubuntu0.3 |
| pocoo | jinja2 | >= 0 < 3.1.2-1ubuntu1.3 | 3.1.2-1ubuntu1.3 |
| pocoo | jinja2 | >= 0 < 3.1.2-1ubuntu1.2 | 3.1.2-1ubuntu1.2 |
| pocoo | jinja2 | >= 0 < 2.7.2-2ubuntu0.1~esm6 | 2.7.2-2ubuntu0.1~esm6 |
| pocoo | jinja2 | >= 0 < 2.8-1ubuntu0.1+esm5 | 2.8-1ubuntu0.1+esm5 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1+esm4 | 2.10-1ubuntu0.18.04.1+esm4 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1+esm3 | 2.10-1ubuntu0.18.04.1+esm3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.4MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.4MEDIUM
vendor_ubuntu8.8HIGH
vendor_msrc7.8HIGH
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Jinja2 regression
vendor_ubuntu·2025-03-12·CVSS 8.8
[HIGH] Jinja2 regression
Title: Jinja2 regression
Summary: USN-7343-1 introduced a regression in Jinja2.
USN-7343-1 fixed vulnerabilities in Jinja2. The update introduced a
regression when attempting to import Jinja2 on Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format me
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2025-03-11·CVSS 8.8
CVE-2025-27516 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in Jinja2.
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format method. An attacker could possibly use
this issue to enable the execution of arbitrary code. This issue only
affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-56326)
It was discovered that Jinja2 sandboxed environments could be escaped
thr
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2025-01-30·CVSS 8.8
CVE-2024-56201 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in jinja2.
It was discovered that Jinja2 incorrectly handled certain filenames when
compiling template content. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2024-56201)
It was discovered that Jinja2 incorrectly handled string formatting calls.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-56326)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
jinja2: Jinja has a sandbox breakout through indirect reference to format method
vendor_redhat·2024-12-23·CVSS 5.4
CVE-2024-56326 [MEDIUM] CWE-94 jinja2: Jinja has a sandbox breakout through indirect reference to format method
jinja2: Jinja has a sandbox breakout through indirect reference to format method
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in
Microsoft
Jinja has a sandbox breakout through indirect reference to format method
vendor_msrc·2024-12-10·CVSS 7.8
CVE-2024-56326 [MEDIUM] CWE-1336 Jinja has a sandbox breakout through indirect reference to format method
Jinja has a sandbox breakout through indirect reference to format method
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
R
Debian
CVE-2024-56326: jinja2 - Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how th...
vendor_debian·2024·CVSS 5.4
CVE-2024-56326 [MEDIUM] CVE-2024-56326: jinja2 - Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how th...
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the
OSV
jinja2 regression
osv·2025-03-12·CVSS 5.4
[MEDIUM] jinja2 regression
jinja2 regression
USN-7343-1 fixed vulnerabilities in Jinja2. The update introduced a
regression when attempting to import Jinja2 on Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format method. An attacker could possibly use
this issue to enable the e
OSV
jinja2 vulnerabilities
osv·2025-03-11·CVSS 5.4
CVE-2024-56201 [MEDIUM] jinja2 vulnerabilities
jinja2 vulnerabilities
Rafal Krupinski discovered that Jinja2 did not properly restrict
the execution of code in situations where templates are used maliciously.
An attacker with control over a template's filename and content could
potentially use this issue to enable the execution of arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2024-56201)
It was discovered that Jinja2 sandboxed environments could be escaped
through a call to a string format method. An attacker could possibly use
this issue to enable the execution of arbitrary code. This issue only
affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2024-56326)
It was discovered that Jinja2 sandboxed environments could be escaped
through the malicious use of certain filters. An attacker could po
OSV
jinja2 vulnerabilities
osv·2025-01-30·CVSS 5.4
CVE-2024-56201 [MEDIUM] jinja2 vulnerabilities
jinja2 vulnerabilities
It was discovered that Jinja2 incorrectly handled certain filenames when
compiling template content. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2024-56201)
It was discovered that Jinja2 incorrectly handled string formatting calls.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-56326)
OSV
Jinja has a sandbox breakout through indirect reference to format method
osv·2024-12-23
CVE-2024-56326 [MEDIUM] Jinja has a sandbox breakout through indirect reference to format method
Jinja has a sandbox breakout through indirect reference to format method
An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in a
OSV
CVE-2024-56326: Jinja is an extensible templating engine
osv·2024-12-23·CVSS 5.4
CVE-2024-56326 [MEDIUM] CVE-2024-56326: Jinja is an extensible templating engine
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the
GHSA
Jinja has a sandbox breakout through indirect reference to format method
ghsa·2024-12-23
CVE-2024-56326 [MEDIUM] CWE-693 Jinja has a sandbox breakout through indirect reference to format method
Jinja has a sandbox breakout through indirect reference to format method
An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in a
No detection rules found.
No public exploits indexed.
arXiv
Vexed by VEX tools: Consistency evaluation of container vulnerability scanners
arxiv_fulltext·2025-03-18
Vexed by VEX tools: Consistency evaluation of container vulnerability scanners
Vexed by VEX tools:
Consistency evaluation of container vulnerability scanners
Yekatierina Churakova0009-0004-0657-095X
Mathias Ekstedt0000-0003-3922-9606
Churakova and Ekstedt
Network and Systems Engineering, KTH Royal Institute of Technology, Stockholm, Sweden
[email protected], [email protected]
## Abstract
This paper presents a study that analyzed state-of-the-art vulnerability scanning tools applied to containers. We have focused the work
on tools following the Vulnerability Exploitability eXchange (VEX)
format, which has been introduced to complement Software Bills of
Material (SBOM) with security advisories of known vulnerabilities.
Being able to get an accurate understanding of vulnerabilities found
in the dependencies of third-party software is critical for secure soft-
ware devel
Bugzilla
CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
bugzilla·2024-12-23·CVSS 5.4
CVE-2024-56326 [MEDIUM] CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filter
2024-12-23
Published