https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:41:48 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:3388 <p><strong>Affected:</strong> AlmaLinux:8: python3-jinja2</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: python3-jinja2</p> <p>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.</p> <p>Security Fix(es):</p> <p>* jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:3388 https://cve.radiocsirt.org/vuln/bdu:2025-06562 bdu:2025-06562 https://cve.radiocsirt.org/vuln/bdu:2025-06562 https://cve.radiocsirt.org/vuln/bell-cve-2025-27516 <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-27516 https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2025-27516 <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2025-27516 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0370 certfr-2025-avi-0370 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0370 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-273516 EUVD-2026-273516 https://cve.radiocsirt.org/vuln/euvd-2026-273516 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27516 <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the |attr filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&#39;s attribute lookup. This vulnerability is fixed in 3.1.6.</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the |attr filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&#39;s attribute lookup. This vulnerability is fixed in 3.1.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-27516 https://cve.radiocsirt.org/vuln/ghsa-cpwx-vrp4-4pq7 <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> https://cve.radiocsirt.org/vuln/ghsa-cpwx-vrp4-4pq7 https://cve.radiocsirt.org/vuln/msrc_cve-2025-27516 msrc_CVE-2025-27516 https://cve.radiocsirt.org/vuln/msrc_cve-2025-27516 https://cve.radiocsirt.org/vuln/oesa-2025-1529 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es):</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&amp;apos;s sandbox does catch calls to str.format and ensures they don&amp;apos;t escape the sandbox. However, it&amp;apos;s possible to use the |attr filter to get a reference to a string&amp;apos;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&amp;apos;s attribute lookup. This vulnerability is fixed in 3.1.6.(CVE-2025-27516)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es):</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&amp;apos;s sandbox does catch calls to str.format and ensures they don&amp;apos;t escape the sandbox. However, it&amp;apos;s possible to use the |attr filter to get a reference to a string&amp;apos;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&amp;apos;s attribute lookup. This vulnerability is fixed in 3.1.6.(CVE-2025-27516)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1529 https://cve.radiocsirt.org/vuln/pysec-2026-1471 <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1471 https://cve.radiocsirt.org/vuln/rhba-2025:3651 <p>gunicorn: HTTP Request Smuggling in benoitc/gunicorn golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh jinja2: Jinja sandbox breakout through attr filter selecting format method</p> <p>gunicorn: HTTP Request Smuggling in benoitc/gunicorn golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh jinja2: Jinja sandbox breakout through attr filter selecting format method</p> https://cve.radiocsirt.org/vuln/rhba-2025:3651 https://cve.radiocsirt.org/vuln/rhsa-2025:3113 <p>jinja2: Jinja sandbox breakout through attr filter selecting format method</p> <p>jinja2: Jinja sandbox breakout through attr filter selecting format method</p> https://cve.radiocsirt.org/vuln/rhsa-2025:3113 https://cve.radiocsirt.org/vuln/suse-su-2025:1004-1 <p>Security update for python-Jinja2</p> <p>Security update for python-Jinja2</p> https://cve.radiocsirt.org/vuln/suse-su-2025:1004-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-27516 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the |attr filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&#39;s attribute lookup. This vulnerability is fixed in 3.1.6.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja&#39;s sandbox does catch calls to str.format and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the |attr filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment&#39;s attribute lookup. This vulnerability is fixed in 3.1.6.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-27516 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0524 <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0524