CVE-2024-22195
Medium
Description
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
SeverityMedium
CVSS5.4
Exploit probability—
ProductPalletsprojects Jinja
PublishedJan 11, 2024
First seenJan 11, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- palletsprojects jinja3.1.3 or later
- jinja23.1.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| palletsprojects jinja | v < 3.1.3 | 3.1.3 |
| jinja2PyPI | v < 3.1.3 | 3.1.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.