Login Request a demo
Medium severity · published Jan 11, 2024
CVE-2024-22195
Jinja is an extensible templating engine
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
Jinja · Palletsprojects
before 3.1.3 · source: NVD
Affected product
JI
Jinja
Palletsprojects
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22195
Release Notes
https://github.com/pallets/jinja/releases/tag/3.1.3
Third Party Advisory
https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/
More from Jinja
8.8
CVE-2025-27516
Jinja is an extensible templating engine
8.8
CVE-2024-56201
Jinja has a sandbox breakout through malicious filenames
8.6
CVE-2016-10745
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape
8.6
CVE-2019-10906
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape
7.8
CVE-2024-56326
Jinja has a sandbox breakout through indirect reference to format method