Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-virtd-libvirtUpgrade python2-setuptoolsUpgrade python2-pyyamlUpgrade python2-pytest-mockUpgrade fence-agents-emersonUpgrade fence-agents-ibm-vpcUpgrade python2-scipyUpgrade python2-psycopg2-testsUpgrade fence-agents-ilo2Upgrade python2-develUpgrade python2-numpy-docUpgrade python2-noseUpgrade python2-docutilsUpgrade python2-virtualenvUpgrade python2-dnsUpgrade fence-agents-ibm-powervsUpgrade fence-agents-kdumpUpgrade fence-agents-cisco-ucsUpgrade fence-agents-rsaUpgrade python2-wheelUpgrade python2-funcsigsUpgrade python2-toolsUpgrade fence-agents-ipmilanUpgrade python2-psycopg2-debugUpgrade python2-attrsUpgrade fence-agents-redfishUpgrade fence-agents-awsUpgrade python2-rpm-macrosUpgrade fence-virtdUpgrade fence-agents-bladecenterUpgrade python2-CythonUpgrade python2-ipaddressUpgrade python2-docsUpgrade python-sqlalchemy-docUpgrade python2-sqlalchemyUpgrade fence-agents-gceUpgrade fence-virtd-cpgUpgrade fence-virtd-tcpUpgrade fence-agents-allUpgrade babelUpgrade python2-setuptools_scmUpgrade python2-mockUpgrade fence-agents-heuristics-pingUpgrade python2-pytestUpgrade fence-agents-virshUpgrade python2-psycopg2Upgrade fence-agents-kubevirtUpgrade fence-agents-ibmbladeUpgrade python2-libsUpgrade python2-coverageUpgrade fence-agents-cisco-mdsUpgrade fence-agents-computeUpgrade fence-agents-azure-armUpgrade python2-debugUpgrade python2-PyMySQLUpgrade fence-agents-sbdUpgrade fence-agents-vmware-soapUpgrade python2-bsonUpgrade fence-agents-brocadeUpgrade fence-agents-amt-wsUpgrade fence-agents-hpbladeUpgrade python2-pyUpgrade fence-agents-aliyunUpgrade python3-jinja2Upgrade python2-pipUpgrade fence-agents-wtiUpgrade fence-virtd-serialUpgrade fence-agents-rsbUpgrade fence-agents-ipduUpgrade fence-agents-ifmibUpgrade python2-backportsUpgrade fence-agents-epsUpgrade python2-lxmlUpgrade fence-agents-apc-snmpUpgrade fence-agents-openstackUpgrade python2-pygmentsUpgrade python2-wheel-wheelUpgrade python2-tkinterUpgrade python2-pytzUpgrade python2-urllib3Upgrade fence-agents-mpathUpgrade fence-agents-scsiUpgrade ha-cloud-supportUpgrade python2-numpy-f2pyUpgrade python2-pluggyUpgrade python2-pymongoUpgrade python2-markupsafeUpgrade python2-numpyUpgrade python-psycopg2-docUpgrade python2-testUpgrade fence-agents-rhevmUpgrade fence-agents-drac5Upgrade python2-pip-wheelUpgrade python2-babelUpgrade fence-virtd-multicastUpgrade fence-agents-zvmUpgrade python2-jinja2Upgrade python2-docs-infoUpgrade python2-setuptools-wheelUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ilo-moonshotUpgrade python2-chardetUpgrade python2-pysocksUpgrade fence-virtUpgrade fence-agents-apcUpgrade fence-agents-vmware-restUpgrade fence-agents-lparUpgrade python2-pymongo-gridfsUpgrade python2-sixUpgrade python2-idnaUpgrade fence-agents-ilo-sshUpgrade python2Upgrade python2-backports-ssl_match_hostnameUpgrade fence-agents-intelmodularUpgrade python-nose-docsUpgrade fence-agents-ilo-mpUpgrade python2-requestsUpgrade fence-agents-common | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python3-jinja2Upgrade python-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-jinja2Upgrade python3-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python2-psycopg2-debugUpgrade python2-setuptoolsUpgrade python2-numpy-docUpgrade fence-agents-eaton-snmpUpgrade fence-agents-lparUpgrade python2-pluggyUpgrade fence-agents-commonUpgrade fence-agents-ifmibUpgrade fence-virtd-serialUpgrade python2-urllib3Upgrade python2-pymongoUpgrade fence-agents-hpbladeUpgrade python2Upgrade python2-wheelUpgrade fence-virtd-multicastUpgrade python2-backportsUpgrade python2-pytzUpgrade fence-agents-ibm-vpcUpgrade fence-agents-apc-snmpUpgrade python2-numpy-f2pyUpgrade fence-agents-apcUpgrade fence-agents-ilo-sshUpgrade fence-agents-vmware-restUpgrade python2-attrsUpgrade python2-idnaUpgrade fence-virtUpgrade python2-jinja2Upgrade python2-markupsafeUpgrade python2-rpm-macrosUpgrade fence-agents-brocadeUpgrade fence-virtd-libvirtUpgrade python2-tkinterUpgrade python-psycopg2-docUpgrade python-sqlalchemy-docUpgrade python2-mockUpgrade python2-testUpgrade python2-pysocksUpgrade python2-psycopg2-testsUpgrade fence-agents-epsUpgrade python2-pygmentsUpgrade python2-lxmlUpgrade fence-agents-wtiUpgrade python2-requestsUpgrade python3-jinja2Upgrade fence-agents-ilo-moonshotUpgrade python2-setuptools_scmUpgrade python2-chardetUpgrade python2-pymongo-gridfsUpgrade python2-wheel-wheelUpgrade python2-backports-ssl_match_hostnameUpgrade python2-sixUpgrade fence-agents-cisco-ucsUpgrade python2-setuptools-wheelUpgrade fence-agents-bladecenterUpgrade python2-develUpgrade python2-psycopg2Upgrade python2-PyMySQLUpgrade python2-scipyUpgrade python2-virtualenvUpgrade python2-docs-infoUpgrade python2-numpyUpgrade fence-agents-drac5Upgrade fence-agents-virshUpgrade python2-pytestUpgrade fence-agents-vmware-soapUpgrade python2-sqlalchemyUpgrade python2-docsUpgrade fence-agents-kubevirtUpgrade fence-agents-ipmilanUpgrade fence-agents-intelmodularUpgrade fence-agents-heuristics-pingUpgrade fence-agents-emersonUpgrade python2-pipUpgrade python2-pyyamlUpgrade fence-agents-allUpgrade python2-bsonUpgrade python2-pip-wheelUpgrade python2-libsUpgrade fence-virtd-cpgUpgrade fence-virtdUpgrade fence-agents-ibmbladeUpgrade fence-agents-rsaUpgrade python2-pyUpgrade fence-agents-cisco-mdsUpgrade fence-agents-sbdUpgrade python2-noseUpgrade python2-babelUpgrade fence-agents-scsiUpgrade fence-agents-rhevmUpgrade fence-agents-ipduUpgrade fence-agents-ibm-powervsUpgrade fence-agents-rsbUpgrade fence-agents-computeUpgrade babelUpgrade python2-toolsUpgrade python2-ipaddressUpgrade python2-funcsigsUpgrade python2-debugUpgrade python2-CythonUpgrade fence-virtd-tcpUpgrade fence-agents-redfishUpgrade fence-agents-ilo2Upgrade python2-docutilsUpgrade python-nose-docsUpgrade python2-pytest-mockUpgrade python2-dnsUpgrade fence-agents-mpathUpgrade fence-agents-amt-wsUpgrade python2-coverageUpgrade fence-agents-kdumpUpgrade fence-agents-ilo-mp | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade python2-debugsourceUpgrade python2-sixUpgrade ha-cloud-supportUpgrade fence-agents-redfishUpgrade Cython-debugsourceUpgrade fence-agents-ibm-powervsUpgrade python2-PyMySQLUpgrade fence-agents-ibmbladeUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtdUpgrade python2-scipyUpgrade python2-pytest-mockUpgrade fence-agents-ipduUpgrade python2-coverageUpgrade fence-agents-rsbUpgrade python2-debugUpgrade python2-docutilsUpgrade python2-pipUpgrade python2-pyyamlUpgrade python2-chardetUpgrade babelUpgrade fence-agents-vmware-soapUpgrade fence-agents-apc-snmpUpgrade fence-virtd-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade python-lxml-debugsourceUpgrade fence-agents-kubevirtUpgrade fence-agents-virshUpgrade fence-agents-mpathUpgrade python2-setuptools-wheelUpgrade fence-virtd-cpgUpgrade python-coverage-debugsourceUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-kdumpUpgrade python2-develUpgrade python-nose-docsUpgrade python2-Cython-debuginfoUpgrade fence-agents-commonUpgrade python-pymongo-debuginfoUpgrade python2-docs-infoUpgrade python2-lxml-debuginfoUpgrade fence-agents-allUpgrade python2-bson-debuginfoUpgrade fence-virtd-tcpUpgrade ha-openstack-support-debuginfoUpgrade python2-babelUpgrade python2-pyUpgrade python2-pymongo-debuginfoUpgrade python2-pip-wheelUpgrade python2-numpyUpgrade python2-ipaddressUpgrade fence-agents-epsUpgrade fence-agents-rhevmUpgrade python2-psycopg2-debug-debuginfoUpgrade fence-agents-cisco-mdsUpgrade fence-agents-ilo-mpUpgrade fence-agents-computeUpgrade fence-agents-debuginfoUpgrade python2-psycopg2Upgrade fence-agents-intelmodularUpgrade python2-numpy-f2pyUpgrade fence-agents-rsaUpgrade fence-agents-heuristics-pingUpgrade fence-agents-sbdUpgrade python2-numpy-debuginfoUpgrade fence-virt-debuginfoUpgrade PyYAML-debugsourceUpgrade python2-docsUpgrade python2-toolsUpgrade fence-agents-azure-armUpgrade fence-agents-amt-wsUpgrade fence-agents-scsiUpgrade python2-noseUpgrade fence-agents-emersonUpgrade fence-agents-bladecenterUpgrade python2-CythonUpgrade python-psycopg2-debuginfoUpgrade python2-wheelUpgrade fence-virtd-cpg-debuginfoUpgrade python2-libsUpgrade fence-agents-aliyunUpgrade fence-virtd-libvirtUpgrade python2-rpm-macrosUpgrade python-sqlalchemy-docUpgrade python2-bsonUpgrade python2-pygmentsUpgrade fence-agents-ilo-sshUpgrade fence-agents-gceUpgrade python2-urllib3Upgrade python2-backportsUpgrade scipy-debugsourceUpgrade fence-agents-zvmUpgrade python2-pluggyUpgrade fence-virtUpgrade python2-scipy-debuginfoUpgrade python2-debuginfoUpgrade fence-agents-ilo2Upgrade python2-markupsafeUpgrade ha-openstack-supportUpgrade fence-agents-apcUpgrade python2-idnaUpgrade python2-backports-ssl_match_hostnameUpgrade fence-virtd-tcp-debuginfoUpgrade python2-psycopg2-debugUpgrade fence-agents-hpbladeUpgrade fence-virtd-multicast-debuginfoUpgrade python2-jinja2Upgrade python2-funcsigsUpgrade fence-agents-wtiUpgrade fence-agents-awsUpgrade python2-sqlalchemyUpgrade python2-wheel-wheelUpgrade python2-pysocksUpgrade python2-setuptools_scmUpgrade python2-pymongo-gridfsUpgrade fence-agents-debugsourceUpgrade fence-agents-drac5Upgrade python2-attrsUpgrade python2-requestsUpgrade python2Upgrade fence-virtd-serialUpgrade fence-agents-ibm-vpcUpgrade fence-agents-ilo-moonshotUpgrade python2-pytestUpgrade python2-numpy-docUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-psycopg2-debuginfoUpgrade fence-agents-ipmilanUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ifmibUpgrade python2-pytzUpgrade python2-virtualenvUpgrade fence-agents-brocadeUpgrade fence-agents-kdump-debuginfoUpgrade python-psycopg2-debugsourceUpgrade python2-mockUpgrade python2-dnsUpgrade python2-coverage-debuginfoUpgrade numpy-debugsourceUpgrade fence-virtd-multicastUpgrade fence-agents-lparUpgrade fence-agents-openstackUpgrade fence-virtd-libvirt-debuginfoUpgrade python2-tkinterUpgrade python-pymongo-debugsourceUpgrade python2-testUpgrade python2-lxmlNo solution existsUpgrade fence-agents-vmware-restUpgrade python2-setuptoolsUpgrade python-psycopg2-docUpgrade python2-pymongoUpgrade fence-agents-cisco-ucsUpgrade python3-jinja2 | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade fence-agents-debugsourceUpgrade numpy-debugsourceUpgrade python-coverage-debugsourceUpgrade python2-psycopg2-debugUpgrade python2-testUpgrade fence-agents-openstackUpgrade python-lxml-debugsourceUpgrade python-psycopg2-debugsourceUpgrade fence-agents-aliyun-debuginfoUpgrade scipy-debugsourceUpgrade python2-psycopg2Upgrade fence-agents-aliyunUpgrade python2-pyyamlUpgrade python2-pymongo-gridfsUpgrade PyYAML-debugsourceUpgrade fence-agents-debuginfoUpgrade fence-agents-kubevirtUpgrade python2-bsonUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python2-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2Upgrade python-pymongo-debugsourceUpgrade python2-numpy-f2pyUpgrade fence-agents-kdumpUpgrade python-psycopg2-docUpgrade python2-coverage-debuginfoUpgrade Cython-debugsourceUpgrade python2-psycopg2-testsUpgrade python2-lxml-debuginfoUpgrade fence-agents-redfishUpgrade python2-CythonUpgrade python2-debugsourceUpgrade python2-scipy-debuginfoUpgrade python2-scipyUpgrade python2-pymongo-debuginfoUpgrade python2-lxmlUpgrade python2-pymongoUpgrade python2-bson-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade fence-agents-allUpgrade python2-develUpgrade python-pymongo-debuginfoUpgrade python2-coverageUpgrade python2-numpy-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpyUpgrade python2-debugUpgrade python2-tkinterUpgrade python2-sqlalchemyUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-toolsUpgrade python2-markupsafeUpgrade python2-libsUpgrade python2-backports | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python311-Jinja2Upgrade python313-Jinja2Upgrade python-Jinja2-emacsUpgrade python-Jinja2-vimUpgrade python3-Jinja2 | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python-jinja2 (Ubuntu Pro)Upgrade python3-jinja2Upgrade python-jinja2 | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub