https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T06:39:32.581031+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2019-10906 CVE-2019-10906 2026-09-28T06:39:32.626402+00:00

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

 https://vulnerability.circl.lu/vuln/ghsa-462w-v97r-4m45 GHSA-462w-v97r-4m45 — Jinja2 sandbox escape via string formatting 2026-09-28T06:39:32.626502+00:00

Affected: PyPI: Jinja2

In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape.

The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.

This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.

If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

 https://vulnerability.circl.lu/vuln/pysec-2019-217 PYSEC-2019-217 2026-09-28T06:39:32.626566+00:00

Affected: PyPI: jinja2

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.