CVE-2024-56201

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56201
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f Patch
https://github.com/pallets/jinja/issues/1792 Issue Tracking
https://github.com/pallets/jinja/releases/tag/3.1.5 Release Notes
https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*
History

22 Sep 2025, 17:45

Type Values Removed Values Added
First Time Palletsprojects
Palletsprojects jinja
CPE cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f - () https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f - Patch
References () https://github.com/pallets/jinja/issues/1792 - () https://github.com/pallets/jinja/issues/1792 - Issue Tracking
References () https://github.com/pallets/jinja/releases/tag/3.1.5 - () https://github.com/pallets/jinja/releases/tag/3.1.5 - Release Notes
References () https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699 - () https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699 - Vendor Advisory

18 Feb 2025, 22:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown

08 Jan 2025, 16:15

Type Values Removed Values Added
Summary
  • (es) Jinja es un motor de plantillas extensible. Antes de 3.1.5, un error en el compilador de Jinja permitía a un atacante que controlaba tanto el contenido como el nombre de archivo de una plantilla ejecutar código Python arbitrario, independientemente de si se utilizaba el entorno limitado de Jinja. Para aprovechar la vulnerabilidad, un atacante necesita controlar tanto el nombre del archivo como el contenido de una plantilla. Que ese sea el caso depende del tipo de aplicación que utilice Jinja. Esta vulnerabilidad afecta a los usuarios de aplicaciones que ejecutan plantillas que no son de confianza donde el autor de la plantilla también puede elegir el nombre del archivo de la plantilla. Esta vulnerabilidad se solucionó en 3.1.5.
Summary (en) Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5. (en) Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

24 Dec 2024, 02:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

23 Dec 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-23 16:15

Updated : 2025-09-22 17:45

NVD link : CVE-2024-56201

Mitre link : CVE-2024-56201

CVE.ORG link : CVE-2024-56201

JSON object : View

Products Affected

palletsprojects

  • jinja
CWE
CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences