CVE-2019-10906

mediumpriority · track · 35EPSS 0.035 · 89 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

3.53% (89th) EPSS

CVSS 5 · medium

Is it mine?

49 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpython-jinja2-0:2.10.1-2.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1152
Fixedpython3-jinja2-0:2.10.1-2.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1152
Fixedrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Fixedrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Fixedrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Workaroundpython-jinja2-0:2.10.1-2.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundpython3-jinja2-0:2.10.1-2.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

cvss

Technical severity, 0–10. One row per scoring source.

9.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 4

v3.08.6highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:Nsecondary · OSV

v3.09criticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.17.9highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-138USCWE-693US

affected products (49)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Red Hat Enterprise Linux 8all versionscert_bundDEcpe:/o:redhat:enterprise_linux:8
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
n/a n/a≤ n/aenisa_euvdEU
canonical ubuntu linux= 12.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 14.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 16.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 18.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 18.10nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 19.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
fedoraproject fedora= 28nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 29nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 30nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
opensuse leap= 15.0nvdUScpe:2.3:o:opensuse:leap:*:*:*:*:*:*:*:*
opensuse leap= 42.3nvdUScpe:2.3:o:opensuse:leap:*:*:*:*:*:*:*:*
palletsprojects jinja< 2.10.1nvdUScpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*
redhat software collections= 1.0nvdUScpe:2.3:a:redhat:software_collections:*:*:*:*:*:*:*:*
PyPI jinja2< 2.10.1osvUSpkg:pypi/jinja2
python-jinja2-0:2.10.1-2.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)all versionsfixedredhat_csafUS

showing 20 of 49

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2019:1152Red Hat Security Advisory: python-jinja2 security update2019-05-13csaf · redhat_csafUS
An update for python-jinja2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1237Red Hat Security Advisory: rh-python35-python-jinja2 security update2019-05-16csaf · redhat_csafUS
An update for rh-python35-python-jinja2 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1329Red Hat Security Advisory: rh-python36-python-jinja2 security update2019-06-04csaf · redhat_csafUS
An update for rh-python36-python-jinja2 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-1440Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2019-05-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-462w-v97r-4m45Jinja2 sandbox escape via string formatting2019-04-10ghsa · osvUS
In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox. This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods. If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
PYSEC-2019-2172019-04-07vendor · osvUS
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd redhat_csaf NVD CVE.org MITRE

published 2019-04-07modified 2026-06-17

references (71)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan