| Package | jinja2 |
|---|---|
| Version | 2.7.3-1+deb8u2 (jessie), 2.8-1+deb9u2 (stretch), 2.10-2+deb10u2 (buster) |
| Related CVEs | CVE-2024-56326 CVE-2025-27516 |
A couple of vulnerabilities were found in jinja2, a template engine. The rendering of untrusted templates could lead to attackers executing arbitrary Python code.
CVE-2024-56326
Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects
calls to str.format allows an attacker that controls the content of a
template to execute arbitrary Python code. To exploit the vulnerability, an
attacker needs to control the content of a template. Whether that is the
case depends on the type of application using Jinja. This vulnerability
impacts users of applications which execute untrusted templates. Jinja's
sandbox does catch calls to str.format and ensures they don't escape the
sandbox. However, it's possible to store a reference to a malicious string's
format method, then pass that to a filter that calls it. No such filters are
built-in to Jinja, but could be present through custom filters in an
application. After the fix, such indirect calls are also handled by the
sandbox.
CVE-2025-27516
Prior to 3.1.6, an oversight in how the Jinja sandboxed environment
interacts with the |attr filter allows an attacker that controls the
content of a template to execute arbitrary Python code. To exploit the
vulnerability, an attacker needs to control the content of a template.
Whether that is the case depends on the type of application using Jinja.
This vulnerability impacts users of applications which execute untrusted
templates. Jinja's sandbox does catch calls to str.format and ensures they
don't escape the sandbox. However, it's possible to use the |attr filter to
get a reference to a string's plain format method, bypassing the sandbox.
After the fix, the |attr filter no longer bypasses the environment's
attribute lookup.
For Debian 10 buster, these problems have been fixed in version 2.10-2+deb10u2.
For Debian 8 jessie, these problems have been fixed in version 2.7.3-1+deb8u2.
For Debian 9 stretch, these problems have been fixed in version 2.8-1+deb9u2.
We recommend that you upgrade your jinja2 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.