CVE-2024-56201

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f	Patch
https://github.com/pallets/jinja/issues/1792	Issue Tracking
https://github.com/pallets/jinja/releases/tag/3.1.5	Release Notes
https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-12-23 16:15

Updated : 2025-09-22 17:45

NVD link : CVE-2024-56201

Mitre link : CVE-2024-56201

CVE.ORG link : CVE-2024-56201

JSON object : View

Products Affected

palletsprojects

jinja

CWE

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

{"id": "CVE-2024-56201", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-12-23T16:15:07.410", "references": [{"url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/pallets/jinja/issues/1792", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/pallets/jinja/releases/tag/3.1.5", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-150"}]}], "descriptions": [{"lang": "en", "value": "Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5."}, {"lang": "es", "value": "Jinja es un motor de plantillas extensible. Antes de 3.1.5, un error en el compilador de Jinja permit\u00eda a un atacante que controlaba tanto el contenido como el nombre de archivo de una plantilla ejecutar c\u00f3digo Python arbitrario, independientemente de si se utilizaba el entorno limitado de Jinja. Para aprovechar la vulnerabilidad, un atacante necesita controlar tanto el nombre del archivo como el contenido de una plantilla. Que ese sea el caso depende del tipo de aplicaci\u00f3n que utilice Jinja. Esta vulnerabilidad afecta a los usuarios de aplicaciones que ejecutan plantillas que no son de confianza donde el autor de la plantilla tambi\u00e9n puede elegir el nombre del archivo de la plantilla. Esta vulnerabilidad se solucion\u00f3 en 3.1.5."}], "lastModified": "2025-09-22T17:45:28.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A50631DE-4A4A-4B19-81C0-4D0597588D7A", "versionEndExcluding": "3.1.5", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}