https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:15:13 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:0308 <p><strong>Affected:</strong> AlmaLinux:9: fence-agents-common, AlmaLinux:9: fence-agents-compute, AlmaLinux:9: fence-agents-ibm-powervs, AlmaLinux:9: fence-agents-ibm-vpc, AlmaLinux:9: fence-agents-kubevirt, AlmaLinux:9: fence-agents-virsh, AlmaLinux:9: fence-virt, AlmaLinux:9: fence-virtd, AlmaLinux:9: fence-virtd-cpg, AlmaLinux:9: fence-virtd-libvirt and 3 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* fence-agents: Jinja has a sandbox breakout through indirect reference to format method [almalinux-9.5.z] (CVE-2024-56326) * fence-agents: Jinja has a sandbox breakout through malicious filenames [almalinux-9.5.z] (CVE-2024-56201)</p> <p><strong>Affected:</strong> AlmaLinux:9: fence-agents-common, AlmaLinux:9: fence-agents-compute, AlmaLinux:9: fence-agents-ibm-powervs, AlmaLinux:9: fence-agents-ibm-vpc, AlmaLinux:9: fence-agents-kubevirt, AlmaLinux:9: fence-agents-virsh, AlmaLinux:9: fence-virt, AlmaLinux:9: fence-virtd, AlmaLinux:9: fence-virtd-cpg, AlmaLinux:9: fence-virtd-libvirt and 3 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* fence-agents: Jinja has a sandbox breakout through indirect reference to format method [almalinux-9.5.z] (CVE-2024-56326) * fence-agents: Jinja has a sandbox breakout through malicious filenames [almalinux-9.5.z] (CVE-2024-56201)</p> https://cve.radiocsirt.org/vuln/alsa-2025:0308 https://cve.radiocsirt.org/vuln/bdu:2025-00113 bdu:2025-00113 https://cve.radiocsirt.org/vuln/bdu:2025-00113 https://cve.radiocsirt.org/vuln/bell-cve-2024-56326 <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-56326 https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2024-56326 <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.</p> <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.</p> https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2024-56326 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0106 certfr-2025-avi-0106 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0106 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-257758 EUVD-2026-257758 https://cve.radiocsirt.org/vuln/euvd-2026-257758 https://cve.radiocsirt.org/vuln/fkie_cve-2024-56326 <p>Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.</p> <p>Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-56326 https://cve.radiocsirt.org/vuln/ghsa-q2x7-8rv6-6q7h <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.</p> https://cve.radiocsirt.org/vuln/ghsa-q2x7-8rv6-6q7h https://cve.radiocsirt.org/vuln/msrc_cve-2024-56326 msrc_CVE-2024-56326 https://cve.radiocsirt.org/vuln/msrc_cve-2024-56326 https://cve.radiocsirt.org/vuln/oesa-2024-2597 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es): Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&amp;apos;s sandbox does catch calls to str.format and ensures they don&amp;apos;t escape the sandbox. However, it&amp;apos;s possible to store a reference to a malicious string&amp;apos;s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.(CVE-2024-56326)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es): Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&amp;apos;s sandbox does catch calls to str.format and ensures they don&amp;apos;t escape the sandbox. However, it&amp;apos;s possible to store a reference to a malicious string&amp;apos;s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.(CVE-2024-56326)</p> https://cve.radiocsirt.org/vuln/oesa-2024-2597 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14997-1 <p>oci-cli-3.54.1-1.1 on GA media</p> <p>oci-cli-3.54.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14997-1 https://cve.radiocsirt.org/vuln/pysec-2026-1475 <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1475 https://cve.radiocsirt.org/vuln/rhba-2025:0301 <p>golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto nanoid: nanoid mishandles non-integer values jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method</p> <p>golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto nanoid: nanoid mishandles non-integer values jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method</p> https://cve.radiocsirt.org/vuln/rhba-2025:0301 https://cve.radiocsirt.org/vuln/suse-su-2025:0016-1 <p>Security update for python-Jinja2</p> <p>Security update for python-Jinja2</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0016-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-56326 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to store a reference to a malicious string&#39;s format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-56326 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0054 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux, Red Hat Ansible Automation Platform und Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux, Red Hat Ansible Automation Platform und Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0054