CVE-2024-56201

Katalog CVE

CVSS 8.8 · High EPSS 0,31%

Kerentanan Improper Neutralization of Escape, Meta, or Control Sequences pada palletsprojects jinja. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

Rincian

Terbit di NVD

23 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699 advisory vendor
• https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f patch
• https://github.com/pallets/jinja/issues/1792 issue tracking
• https://github.com/pallets/jinja/releases/tag/3.1.5 release notes