https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:27:02 +0000 https://vulnerability.circl.lu/vuln/cve-2025-27516 <p><strong>Affected:</strong> pallets jinja</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the |attr filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&#39;s attribute lookup. This vulnerability is fixed in 3.1.6.</p> <p><strong>Affected:</strong> pallets jinja</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the |attr filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&#39;s attribute lookup. This vulnerability is fixed in 3.1.6.</p> https://vulnerability.circl.lu/vuln/cve-2025-27516 https://vulnerability.circl.lu/vuln/ghsa-cpwx-vrp4-4pq7 <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> https://vulnerability.circl.lu/vuln/ghsa-cpwx-vrp4-4pq7 https://vulnerability.circl.lu/vuln/pysec-2026-1471 <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> https://vulnerability.circl.lu/vuln/pysec-2026-1471