Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-pipUpgrade fence-agents-scsiUpgrade fence-agents-commonUpgrade python2-backportsUpgrade fence-agents-mpathUpgrade fence-agents-apc-snmpUpgrade python-psycopg2-docUpgrade python2-setuptools-wheelUpgrade fence-virtd-multicastUpgrade python2-numpyUpgrade python2-wheel-wheelUpgrade python2-pymongoUpgrade python2-markupsafeUpgrade fence-virtd-serialUpgrade python2-numpy-f2pyUpgrade fence-agents-openstackUpgrade fence-agents-ilo-moonshotUpgrade python2-lxmlUpgrade fence-agents-zvmUpgrade fence-agents-ipduUpgrade python2-pip-wheelUpgrade fence-agents-eaton-snmpUpgrade fence-agents-wtiUpgrade fence-agents-drac5Upgrade ha-cloud-supportUpgrade python2-babelUpgrade python2-urllib3Upgrade fence-agents-hpbladeUpgrade python2-pygmentsUpgrade fence-virtUpgrade fence-agents-rhevmUpgrade python2-sixUpgrade python2-docs-infoUpgrade fence-agents-apcUpgrade python2-testUpgrade fence-agents-ifmibUpgrade python2-tkinterUpgrade python3-jinja2Upgrade python2-idnaUpgrade python2-pymongo-gridfsUpgrade fence-agents-vmware-restUpgrade python2-pytzUpgrade fence-agents-aliyunUpgrade fence-agents-ilo-mpUpgrade python2-chardetUpgrade python2-requestsUpgrade python2-pyUpgrade fence-agents-rsbUpgrade fence-agents-ilo-sshUpgrade fence-agents-intelmodularUpgrade python2-backports-ssl_match_hostnameUpgrade fence-agents-lparUpgrade python2-pluggyUpgrade python2-pysocksUpgrade python-nose-docsUpgrade python2Upgrade python2-jinja2Upgrade fence-agents-epsUpgrade python2-pytest-mockUpgrade python2-PyMySQLUpgrade fence-agents-emersonUpgrade python2-CythonUpgrade python2-coverageUpgrade fence-agents-gceUpgrade fence-agents-ilo2Upgrade fence-agents-redfishUpgrade python2-virtualenvUpgrade fence-agents-rsaUpgrade python2-sqlalchemyUpgrade python2-setuptoolsUpgrade python2-scipyUpgrade python2-dnsUpgrade fence-virtd-libvirtUpgrade python2-wheelUpgrade fence-agents-ipmilanUpgrade fence-agents-kubevirtUpgrade python2-pytestUpgrade fence-agents-awsUpgrade python2-setuptools_scmUpgrade fence-agents-vmware-soapUpgrade fence-agents-sbdUpgrade fence-virtdUpgrade python2-ipaddressUpgrade babelUpgrade fence-agents-heuristics-pingUpgrade fence-agents-amt-wsUpgrade python2-bsonUpgrade fence-agents-kdumpUpgrade fence-agents-virshUpgrade python2-numpy-docUpgrade python2-docutilsUpgrade fence-agents-computeUpgrade fence-agents-bladecenterUpgrade python-sqlalchemy-docUpgrade python2-funcsigsUpgrade python2-debugUpgrade python2-mockUpgrade fence-agents-brocadeUpgrade fence-agents-ibm-powervsUpgrade python2-rpm-macrosUpgrade python2-psycopg2-debugUpgrade fence-virtd-cpgUpgrade fence-agents-cisco-mdsUpgrade python2-docsUpgrade python2-noseUpgrade fence-agents-allUpgrade python2-psycopg2-testsUpgrade python2-libsUpgrade python2-pyyamlUpgrade fence-agents-ibmbladeUpgrade python2-toolsUpgrade fence-agents-cisco-ucsUpgrade python2-psycopg2Upgrade python2-attrsUpgrade fence-agents-azure-armUpgrade fence-agents-ibm-vpcUpgrade fence-virtd-tcpUpgrade python2-devel | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python3-jinja2Upgrade python-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-jinja2Upgrade python3-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python2-psycopg2-testsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-mockUpgrade python2-pysocksUpgrade fence-agents-vmware-restUpgrade python2-testUpgrade python2Upgrade python2-tkinterUpgrade fence-agents-ilo-moonshotUpgrade fence-virtd-libvirtUpgrade python2-pymongo-gridfsUpgrade python2-wheel-wheelUpgrade python2-pluggyUpgrade fence-agents-brocadeUpgrade python-psycopg2-docUpgrade python2-requestsUpgrade python2-chardetUpgrade python-sqlalchemy-docUpgrade python2-pymongoUpgrade python2-backportsUpgrade fence-agents-apc-snmpUpgrade python2-attrsUpgrade python2-rpm-macrosUpgrade fence-agents-ibm-vpcUpgrade fence-agents-apcUpgrade fence-agents-ilo-sshUpgrade fence-agents-commonUpgrade python2-idnaUpgrade fence-agents-epsUpgrade python2-jinja2Upgrade python2-markupsafeUpgrade fence-agents-lparUpgrade python2-sixUpgrade fence-agents-hpbladeUpgrade python2-setuptools_scmUpgrade python2-numpy-f2pyUpgrade fence-agents-wtiUpgrade python3-jinja2Upgrade python2-urllib3Upgrade fence-agents-eaton-snmpUpgrade python2-pygmentsUpgrade python2-lxmlUpgrade fence-agents-cisco-ucsUpgrade python2-psycopg2-debugUpgrade python2-setuptoolsUpgrade fence-agents-ifmibUpgrade fence-virtUpgrade fence-virtd-multicastUpgrade fence-virtd-serialUpgrade python2-pytzUpgrade python2-numpy-docUpgrade python2-wheelUpgrade python2-docs-infoUpgrade python2-debugUpgrade python2-ipaddressUpgrade python2-develUpgrade fence-agents-virshUpgrade python2-toolsUpgrade python2-funcsigsUpgrade fence-agents-redfishUpgrade fence-agents-ilo2Upgrade babelUpgrade python2-setuptools-wheelUpgrade python2-psycopg2Upgrade python2-coverageUpgrade fence-agents-kdumpUpgrade fence-agents-ilo-mpUpgrade fence-virtd-cpgUpgrade fence-virtdUpgrade python2-pip-wheelUpgrade python2-libsUpgrade python2-bsonUpgrade fence-agents-ibmbladeUpgrade fence-agents-rsbUpgrade fence-agents-ipduUpgrade python2-pytest-mockUpgrade python2-pyUpgrade python2-dnsUpgrade python2-pyyamlUpgrade python2-pytestUpgrade python2-pipUpgrade fence-agents-vmware-soapUpgrade fence-agents-amt-wsUpgrade python2-docutilsUpgrade python-nose-docsUpgrade fence-agents-mpathUpgrade python2-CythonUpgrade python2-scipyUpgrade python2-PyMySQLUpgrade python2-numpyUpgrade fence-agents-rsaUpgrade fence-agents-drac5Upgrade fence-agents-cisco-mdsUpgrade fence-agents-bladecenterUpgrade python2-virtualenvUpgrade fence-agents-intelmodularUpgrade fence-agents-heuristics-pingUpgrade python2-docsUpgrade fence-agents-kubevirtUpgrade fence-agents-ipmilanUpgrade fence-agents-emersonUpgrade fence-agents-allUpgrade python2-sqlalchemyUpgrade fence-agents-computeUpgrade python2-noseUpgrade python2-babelUpgrade fence-agents-rhevmUpgrade fence-agents-ibm-powervsUpgrade fence-agents-scsiUpgrade fence-agents-sbdUpgrade fence-virtd-tcp | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade python2-psycopg2-debugUpgrade python2-requestsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-setuptools_scmUpgrade python2-funcsigsUpgrade fence-agents-brocadeUpgrade python2-sqlalchemyUpgrade fence-virtd-serialUpgrade fence-agents-eaton-snmpUpgrade python2-virtualenvUpgrade fence-virtd-tcp-debuginfoUpgrade python2-jinja2Upgrade fence-agents-hpbladeUpgrade python2-pluggyUpgrade python2-psycopg2-testsUpgrade python-pymongo-debugsourceUpgrade python2-coverage-debuginfoUpgrade fence-virtd-multicastUpgrade fence-agents-openstackUpgrade numpy-debugsourceUpgrade fence-agents-vmware-restUpgrade python2-dnsNo solution existsUpgrade python2-scipy-debuginfoUpgrade fence-agents-gceUpgrade fence-agents-zvmUpgrade python2-backportsUpgrade python2-lxmlUpgrade python2-testUpgrade scipy-debugsourceUpgrade python2-rpm-macrosUpgrade fence-agents-apcUpgrade fence-virtd-multicast-debuginfoUpgrade ha-openstack-supportUpgrade python2-debuginfoUpgrade python2-markupsafeUpgrade fence-agents-lparUpgrade python2-idnaUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python2-attrsUpgrade fence-agents-ifmibUpgrade python2-tkinterUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-ilo-moonshotUpgrade python2-mockUpgrade python2-numpy-docUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-ilo2Upgrade python2Upgrade python2-pytestUpgrade python2-pytzUpgrade python2-pygmentsUpgrade python2-wheel-wheelUpgrade fence-agents-drac5Upgrade fence-agents-awsUpgrade fence-agents-debugsourceUpgrade fence-agents-wtiUpgrade python-sqlalchemy-docUpgrade python2-bsonUpgrade python2-pysocksUpgrade python2-pymongo-gridfsUpgrade fence-agents-ilo-sshUpgrade fence-virtUpgrade fence-agents-cisco-ucsUpgrade python2-pymongoUpgrade python3-jinja2Upgrade python2-setuptoolsUpgrade python2-urllib3Upgrade python-psycopg2-docUpgrade fence-agents-ibm-vpcUpgrade python-psycopg2-debugsourceUpgrade fence-agents-ipmilanUpgrade python2-noseUpgrade fence-agents-virshUpgrade fence-agents-apc-snmpUpgrade python2-numpy-debuginfoUpgrade fence-agents-ipduUpgrade python2-babelUpgrade fence-agents-computeUpgrade python2-wheelUpgrade python-psycopg2-debuginfoUpgrade fence-agents-rsbUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-lxml-debuginfoUpgrade python2-Cython-debuginfoUpgrade Cython-debugsourceUpgrade fence-agents-vmware-soapUpgrade python2-docutilsUpgrade fence-virtd-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade python2-debugUpgrade python-lxml-debugsourceUpgrade fence-agents-aliyun-debuginfoUpgrade python2-pip-wheelUpgrade fence-virtd-tcpUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-kdumpUpgrade fence-agents-epsUpgrade python2-pyUpgrade python2-pymongo-debuginfoUpgrade ha-openstack-support-debuginfoUpgrade python2-libsUpgrade fence-agents-allUpgrade python2-docs-infoUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-ibmbladeUpgrade python2-pipUpgrade python-coverage-debugsourceUpgrade python2-PyMySQLUpgrade babelUpgrade fence-agents-kubevirtUpgrade python-pymongo-debuginfoUpgrade fence-agents-azure-armUpgrade fence-agents-emersonUpgrade python2-scipyUpgrade python2-pytest-mockUpgrade fence-virtd-cpgUpgrade python2-chardetUpgrade python2-pyyamlUpgrade python2-docsUpgrade python2-bson-debuginfoUpgrade python-nose-docsUpgrade fence-agents-commonUpgrade python2-debugsourceUpgrade python2-coverageUpgrade fence-virtdUpgrade python2-sixUpgrade fence-agents-ibm-powervsUpgrade PyYAML-debugsourceUpgrade fence-agents-redfishUpgrade python2-ipaddressUpgrade fence-agents-amt-wsUpgrade python2-psycopg2-debug-debuginfoUpgrade fence-agents-heuristics-pingUpgrade python2-toolsUpgrade fence-agents-rhevmUpgrade python2-develUpgrade python2-psycopg2Upgrade fence-agents-cisco-mdsUpgrade fence-virt-debuginfoUpgrade ha-cloud-supportUpgrade python2-numpy-f2pyUpgrade python2-setuptools-wheelUpgrade fence-agents-intelmodularUpgrade fence-agents-bladecenterUpgrade fence-agents-scsiUpgrade fence-agents-sbdUpgrade python2-numpyUpgrade python2-CythonUpgrade fence-agents-rsaUpgrade fence-agents-mpathUpgrade fence-agents-ilo-mpUpgrade fence-agents-debuginfoUpgrade fence-agents-aliyunUpgrade fence-virtd-libvirt | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade python-psycopg2-debugsourceUpgrade PyYAML-debugsourceUpgrade fence-agents-kubevirtUpgrade python2-coverage-debuginfoUpgrade python2-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-psycopg2Upgrade python2-psycopg2-debugUpgrade fence-agents-debuginfoUpgrade python-psycopg2-docUpgrade python2Upgrade numpy-debugsourceUpgrade fence-agents-kdumpUpgrade python2-lxml-debuginfoUpgrade Cython-debugsourceUpgrade python2-bsonUpgrade fence-agents-aliyun-debuginfoUpgrade python2-testUpgrade python2-pyyamlUpgrade python2-Cython-debuginfoUpgrade fence-agents-aliyunUpgrade python2-psycopg2-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-agents-openstackUpgrade scipy-debugsourceUpgrade python-pymongo-debugsourceUpgrade python2-numpy-f2pyUpgrade python-lxml-debugsourceUpgrade python2-pymongo-gridfsUpgrade python-coverage-debugsourceUpgrade python2-backportsUpgrade python2-toolsUpgrade python2-bson-debuginfoUpgrade python2-debugsourceUpgrade fence-agents-redfishUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-sqlalchemyUpgrade python2-tkinterUpgrade python-pymongo-debuginfoUpgrade python2-coverageUpgrade python2-pymongoUpgrade python2-numpy-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-CythonUpgrade fence-agents-allUpgrade python2-pyyaml-debuginfoUpgrade python2-lxmlUpgrade python2-develUpgrade python2-numpyUpgrade python2-debugUpgrade python2-pymongo-debuginfoUpgrade python2-scipyUpgrade python2-markupsafeUpgrade python2-libs | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python3-Jinja2Upgrade python311-Jinja2Upgrade python-Jinja2-emacsUpgrade python313-Jinja2Upgrade python-Jinja2-vim | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python-jinja2Upgrade python-jinja2 (Ubuntu Pro)Upgrade python3-jinja2Upgrade python3-jinja2 (Ubuntu Pro) | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
