Jinja2

This hub aggregates every CVE we track for Jinja2, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Jinja2.

• CVE-2025-27516Jinja sandbox breakout through attr filter selecting format method8.8Mar 5, 2025
• CVE-2024-56326Jinja has a sandbox breakout through indirect reference to format method7.8Dec 23, 2024
• CVE-2024-56201Jinja has a sandbox breakout through malicious filenames8.8Dec 23, 2024
• CVE-2024-34064Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter5.4May 6, 2024
• CVE-2024-22195Jinja vulnerable to Cross-Site Scripting (XSS)5.4Jan 11, 2024
• CVE-2020-28493Regular Expression Denial of Service (ReDoS)5.3Feb 1, 2021
• CVE-2016-10745In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.8.6Apr 8, 2019
• CVE-2019-10906In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.8.6Apr 6, 2019
• CVE-2019-8341An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then r...9.8Feb 15, 2019
• CVE-2014-1402The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file ...4.4May 19, 2014
• CVE-2014-0012FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: t...4.4May 19, 2014