p PatchFirst

CVE-2024-22195

CVE-2024-22195 · Jinja vulnerable to Cross-Site Scripting (XSS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

CVSS 5.4 · Medium · EPSS 0.9% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • jinja

    Versions
    • < 3.1.3: Affected

    No fix published

  • jinja2 Debian:12

    Versions
    • 3.1.2-1
    Affected ranges
    • ECOSYSTEM: < 3.1.2-1+deb12u1

    Update to 3.1.2-1+deb12u1

  • jinja2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.3-1

    Update to 3.1.3-1

  • jinja2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.3-1

    Update to 3.1.3-1

  • jinja2 PyPI

    Versions
    • 2.0
    • 2.0rc1
    • 2.1
    • 2.1.1
    • 2.10
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.11.3
    • 2.2
    • 2.2.1
    • 2.3
    • 2.3.1
    • 2.4
    • 2.4.1
    • 2.5
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.5.5
    • 2.6
    • 2.7
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.8
    • 2.8.1
    • 2.9
    • 2.9.1
    • 2.9.2
    • 2.9.3
    • 2.9.4
    • 2.9.5
    • 2.9.6
    • 3.0.0
    • 3.0.0a1
    • 3.0.0rc1
    • 3.0.0rc2
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.1.0
    • 3.1.1
    • 3.1.2
    Affected ranges
    • ECOSYSTEM: < 3.1.3

    Update to 3.1.3

  • jinja2 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.7-3
    • 2.7.1-1
    • 2.7.2-1
    • 2.7.2-2
    • 2.7.2-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 2.7.2-2ubuntu0.1~esm2

    Update to 2.7.2-2ubuntu0.1~esm2

  • jinja2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.8-1
    • 2.8-1ubuntu0.1
    • 2.8-1ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 2.8-1ubuntu0.1+esm2

    Update to 2.8-1ubuntu0.1+esm2

  • jinja2 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.9.6-1
    • 2.10-1
    • 2.10-1ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 2.10-1ubuntu0.18.04.1+esm1

    Update to 2.10-1ubuntu0.18.04.1+esm1

  • jinja2 Ubuntu:20.04:LTS

    Versions
    • 2.10-2ubuntu1
    • 2.10-2ubuntu2
    • 2.10.1-1ubuntu1
    • 2.10.1-2
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2ubuntu0.2

    Update to 2.10.1-2ubuntu0.2

  • jinja2 Ubuntu:22.04:LTS

    Versions
    • 2.11.3-1
    • 3.0.1-2
    • 3.0.3-1
    Affected ranges
    • ECOSYSTEM: < 3.0.3-1ubuntu0.1

    Update to 3.0.3-1ubuntu0.1

  • jinja2 Ubuntu:24.04:LTS

    Versions
    • 3.1.2-1
    Affected ranges
    • ECOSYSTEM: < 3.1.2-1ubuntu1

    Update to 3.1.2-1ubuntu1

Original sources

Check your server →