CVE-2024-56201
highPriorität · verfolgen · 35EPSS 0.003 · 23. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2–8.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (54)
Betroffene Produkte und Versionsbereiche.
- IBM InfoSphere Information Server 11.7alle Versionencert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
- Red Hat Ansible Automation Platformalle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:-
- Red Hat Ansible Automation Platform 2.4alle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:2.4
- Red Hat Ansible Automation Platform Container Releasealle Versionencert_bundDEcpe:/a:redhat:ansible_automation_platform:::container_release
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2025-0054Red Hat Enterprise Linux (Jinja): Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2025-01-13csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux, Red Hat Ansible Automation Platform und Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.
- GHSA-gmj6-6f8f-6699Jinja has a sandbox breakout through malicious filenames2024-12-23ghsa · osvUS
A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.
- PYSEC-2026-1472Jinja has a sandbox breakout through malicious filenames2026-07-07vendor · osvUS
A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2024-56201cnnvd
- https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51fcnnvd
- https://github.com/pallets/jinja/issues/1792cnnvd
- https://github.com/pallets/jinja/releases/tag/3.1.5cnnvd
- https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-56201cnnvd
- https://vigilance.fr/vulnerability/Jinja-code-execution-via-Template-Filename-Contents-45994cnnvd
- https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51fenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan