https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:50:37 +0000 https://db.gcve.eu/vuln/ghsa-cpwx-vrp4-4pq7 <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.</p> <p>To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.</p> <p>Jinja&#39;s sandbox does catch calls to `str.format` and ensures they don&#39;t escape the sandbox. However, it&#39;s possible to use the `|attr` filter to get a reference to a string&#39;s plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment&#39;s attribute lookup.</p> https://db.gcve.eu/vuln/ghsa-cpwx-vrp4-4pq7