https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:17:18.590127+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2019-10906 Withdrawn: BELL-CVE-2019-10906 — CVE-2019-10906 does not affect BellSoft software 2026-10-03T11:17:19.327681+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/brew-ansible-cve-2019-10906 BREW-ansible-CVE-2019-10906 — Jinja2 sandbox escape via string formatting 2026-10-03T11:17:19.327732+00:00

Affected: Homebrew: ansible

In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape.

The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.

This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.

If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

 https://cve.radiocsirt.org/vuln/euvd-2026-54047 EUVD-2026-54047 2026-10-03T11:17:19.327772+00:00 EUVD-2026-54047 https://cve.radiocsirt.org/vuln/fkie_cve-2019-10906 fkie_cve-2019-10906 2026-10-03T11:17:19.327787+00:00

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

 https://cve.radiocsirt.org/vuln/ghsa-462w-v97r-4m45 GHSA-462w-v97r-4m45 — Jinja2 sandbox escape via string formatting 2026-10-03T11:17:19.327809+00:00

Affected: PyPI: Jinja2

In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape.

The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.

This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.

If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

 https://cve.radiocsirt.org/vuln/gsd-2019-10906 gsd-2019-10906 2026-10-03T11:17:19.327835+00:00 gsd-2019-10906 https://cve.radiocsirt.org/vuln/msrc_cve-2019-10906 msrc_CVE-2019-10906 — In Pallets Jinja before 2.10.1 str.format_map allows a sandbox escape. 2026-10-03T11:17:19.327847+00:00 msrc_CVE-2019-10906 https://cve.radiocsirt.org/vuln/opensuse-su-2019:1395-1 openSUSE-SU-2019:1395-1 — Security update for python-Jinja2 2026-10-03T11:17:19.327863+00:00

Security update for python-Jinja2

 https://cve.radiocsirt.org/vuln/pysec-2019-217 PYSEC-2019-217 2026-10-03T11:17:19.327881+00:00

Affected: PyPI: jinja2

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

 https://cve.radiocsirt.org/vuln/rhsa-2019:1237 RHSA-2019:1237 — Red Hat Security Advisory: rh-python35-python-jinja2 security update 2026-10-03T11:17:19.327900+00:00

python-jinja2: Sandbox escape due to information disclosure via str.format python-jinja2: str.format_map allows sandbox escape

 https://cve.radiocsirt.org/vuln/suse-su-2019:1156-1 SUSE-SU-2019:1156-1 — Security update for python-Jinja2 2026-10-03T11:17:19.327919+00:00

Security update for python-Jinja2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-10906 UBUNTU-CVE-2019-10906 2026-10-03T11:17:19.327943+00:00

Affected: Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:16.04:LTS: jinja2, Ubuntu:18.04:LTS: jinja2

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1440 WID-SEC-W-2024-1440 — Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T11:17:19.327966+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.