Login Request a demo
Medium severity · published Jan 11, 2024
CVE-2024-22195
Jinja vulnerable to Cross-Site Scripting (XSS)
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
jinja · pallets
< 3.1.3 · source: vendor, NVD
Affected product
JI
jinja
pallets
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22195
Release Notes
https://github.com/pallets/jinja/releases/tag/3.1.3
Third Party Advisory
https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/
More from jinja
8.8
CVE-2025-27516
Jinja sandbox breakout through attr filter selecting format method
8.8
CVE-2024-56201
Jinja has a sandbox breakout through malicious filenames
7.8
CVE-2024-56326
Jinja has a sandbox breakout through indirect reference to format method
5.4
CVE-2024-34064
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter