CVE-2024-56201

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

Affected products

Alt Linux, Almalinux, Astra Linux, Debian, Jinja, Linuxmint, Red Hat, Red Os

Palletsprojects Jinja

< 3.1.5

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

0.3% (23th percentile)

Weakness

CWE-150

NVD status

Analyzed

Published

2024-12-23

No exploit for CVE-2024-56201 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.