Sandbox Bypass Affecting jinja2 package, versions [2.5, 2.8.1)
Snyk CVSS
Attack Complexity
Low
Scope
Changed
Confidentiality
High
Threat Intelligence
EPSS
0.43% (75th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JINJA2-455616
- published 30 Jul 2019
- disclosed 29 Dec 2016
- credit Unknown
Introduced: 29 Dec 2016
CVE-2016-10745 Open this link in a new tabHow to fix?
Upgrade Jinja2 to version 2.8.1 or higher.
Overview
Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.
Affected versions of this package are vulnerable to Sandbox Bypass. Users were allowed to insert str.format through web templates, leading to an escape from sandbox.