Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-virtualenvUpgrade fence-agents-brocadeUpgrade python2-mockUpgrade fence-agents-ibm-powervsUpgrade python2-debugUpgrade fence-agents-ilo2Upgrade python2-psycopg2-testsUpgrade fence-agents-emersonUpgrade fence-agents-virshUpgrade python2-rpm-macrosUpgrade python2-libsUpgrade fence-agents-sbdUpgrade fence-agents-ibmbladeUpgrade python2-dnsUpgrade fence-agents-ibm-vpcUpgrade babelUpgrade fence-agents-ipmilanUpgrade fence-agents-kdumpUpgrade fence-agents-heuristics-pingUpgrade fence-agents-computeUpgrade fence-agents-bladecenterUpgrade fence-virtd-libvirtUpgrade python2-sqlalchemyUpgrade python2-psycopg2-debugUpgrade python2-scipyUpgrade python2-psycopg2Upgrade python2-attrsUpgrade fence-agents-redfishUpgrade python2-pytestUpgrade python2-PyMySQLUpgrade fence-virtd-tcpUpgrade python2-docsUpgrade fence-agents-kubevirtUpgrade python2-develUpgrade fence-agents-amt-wsUpgrade fence-agents-rsaUpgrade python2-pyyamlUpgrade python2-pytest-mockUpgrade python2-bsonUpgrade fence-agents-allUpgrade python2-toolsUpgrade python2-funcsigsUpgrade python2-coverageUpgrade python2-numpy-docUpgrade fence-agents-azure-armUpgrade fence-virtdUpgrade fence-agents-cisco-ucsUpgrade python2-setuptoolsUpgrade python-sqlalchemy-docUpgrade python2-noseUpgrade python2-ipaddressUpgrade fence-virtd-cpgUpgrade python2-CythonUpgrade python2-docutilsUpgrade python2-setuptools_scmUpgrade fence-agents-vmware-soapUpgrade fence-agents-cisco-mdsUpgrade fence-agents-gceUpgrade fence-agents-awsUpgrade python2-wheelUpgrade fence-virtUpgrade fence-agents-lparUpgrade fence-agents-wtiUpgrade python2-pysocksUpgrade fence-agents-zvmUpgrade fence-agents-eaton-snmpUpgrade python2-lxmlUpgrade fence-agents-ipduUpgrade python3-jinja2Upgrade python2-sixUpgrade python-nose-docsUpgrade fence-virtd-multicastUpgrade python2-babelUpgrade python2-numpyUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-ifmibUpgrade fence-agents-mpathUpgrade python2-pytzUpgrade python2-urllib3Upgrade python2-markupsafeUpgrade fence-agents-scsiUpgrade ha-cloud-supportUpgrade python2-pluggyUpgrade fence-agents-ilo-mpUpgrade python-psycopg2-docUpgrade fence-agents-rsbUpgrade fence-virtd-serialUpgrade python2-numpy-f2pyUpgrade fence-agents-apcUpgrade fence-agents-apc-snmpUpgrade python2-chardetUpgrade fence-agents-openstackUpgrade python2-backports-ssl_match_hostnameUpgrade python2Upgrade fence-agents-ilo-sshUpgrade fence-agents-intelmodularUpgrade python2-requestsUpgrade python2-testUpgrade fence-agents-rhevmUpgrade fence-agents-commonUpgrade python2-pip-wheelUpgrade python2-pipUpgrade python2-pymongoUpgrade fence-agents-drac5Upgrade python2-tkinterUpgrade fence-agents-hpbladeUpgrade fence-agents-vmware-restUpgrade python2-backportsUpgrade python2-idnaUpgrade python2-jinja2Upgrade fence-agents-epsUpgrade python2-wheel-wheelUpgrade python2-pymongo-gridfsUpgrade python2-pyUpgrade python2-setuptools-wheelUpgrade python2-docs-infoUpgrade python2-pygmentsUpgrade fence-agents-aliyun | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-jinja2Upgrade python3-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-jinja2Upgrade python2-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python2-chardetUpgrade python2-pymongo-gridfsUpgrade python2-sixUpgrade fence-agents-epsUpgrade python2-requestsUpgrade python2-setuptools_scmUpgrade python2-backports-ssl_match_hostnameUpgrade python2-psycopg2-debugUpgrade fence-agents-lparUpgrade fence-agents-commonUpgrade python2Upgrade fence-agents-ifmibUpgrade python2-setuptoolsUpgrade fence-virtd-libvirtUpgrade python2-wheel-wheelUpgrade python2-pysocksUpgrade python-sqlalchemy-docUpgrade fence-virtd-serialUpgrade python-psycopg2-docUpgrade python2-testUpgrade python2-psycopg2-testsUpgrade fence-agents-ibm-vpcUpgrade fence-agents-hpbladeUpgrade fence-agents-apc-snmpUpgrade fence-agents-brocadeUpgrade python2-numpy-f2pyUpgrade python2-pymongoUpgrade python2-backportsUpgrade python2-pluggyUpgrade python2-mockUpgrade python2-numpy-docUpgrade python2-jinja2Upgrade python2-tkinterUpgrade fence-agents-eaton-snmpUpgrade python2-urllib3Upgrade python3-jinja2Upgrade python2-wheelUpgrade fence-agents-cisco-ucsUpgrade python2-pytzUpgrade fence-agents-ilo-moonshotUpgrade python2-markupsafeUpgrade python2-rpm-macrosUpgrade fence-virtd-multicastUpgrade fence-agents-wtiUpgrade fence-agents-vmware-restUpgrade fence-virtUpgrade fence-agents-ilo-sshUpgrade python2-attrsUpgrade fence-agents-apcUpgrade python2-idnaUpgrade python2-lxmlUpgrade python2-pygmentsUpgrade fence-agents-sbdUpgrade fence-agents-rsbUpgrade fence-agents-ibm-powervsUpgrade python2-toolsUpgrade fence-agents-scsiUpgrade fence-agents-computeUpgrade python2-noseUpgrade python2-babelUpgrade fence-agents-rhevmUpgrade fence-agents-ipduUpgrade python2-setuptools-wheelUpgrade python2-psycopg2Upgrade fence-agents-kdumpUpgrade fence-agents-ilo-mpUpgrade python2-coverageUpgrade python2-docs-infoUpgrade python2-PyMySQLUpgrade python2-virtualenvUpgrade fence-agents-drac5Upgrade fence-agents-virshUpgrade python2-scipyUpgrade python2-numpyUpgrade python2-develUpgrade fence-agents-rsaUpgrade fence-agents-cisco-mdsUpgrade fence-agents-bladecenterUpgrade python2-sqlalchemyUpgrade fence-agents-emersonUpgrade fence-agents-allUpgrade python2-docsUpgrade fence-agents-kubevirtUpgrade fence-agents-ipmilanUpgrade fence-agents-intelmodularUpgrade fence-agents-heuristics-pingUpgrade python2-pipUpgrade python2-pytest-mockUpgrade python2-pyUpgrade python2-dnsUpgrade python-nose-docsUpgrade fence-agents-mpathUpgrade fence-agents-ibmbladeUpgrade python2-bsonUpgrade fence-virtd-cpgUpgrade python2-pip-wheelUpgrade python2-libsUpgrade fence-agents-vmware-soapUpgrade python2-pytestUpgrade python2-pyyamlUpgrade fence-agents-amt-wsUpgrade fence-virtdUpgrade python2-docutilsUpgrade python2-ipaddressUpgrade python2-funcsigsUpgrade python2-debugUpgrade python2-CythonUpgrade fence-virtd-tcpUpgrade fence-agents-redfishUpgrade fence-agents-ilo2Upgrade babel | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade fence-agents-ilo-moonshotUpgrade python2-requestsUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ipmilanUpgrade python2-psycopg2-debuginfoUpgrade fence-agents-hpbladeUpgrade python2-jinja2Upgrade python2-funcsigsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-debuginfoUpgrade python2-pymongo-gridfsUpgrade python-sqlalchemy-docUpgrade python2-pyyaml-debuginfoUpgrade python2-mockUpgrade fence-virtd-tcp-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-tkinterUpgrade fence-agents-openstackUpgrade fence-agents-lparUpgrade numpy-debugsourceUpgrade python2-coverage-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-multicastUpgrade python2-dnsUpgrade scipy-debugsourceUpgrade python2-pygmentsNo solution existsUpgrade fence-agents-apcUpgrade python3-jinja2Upgrade python-psycopg2-docUpgrade python2-pluggyUpgrade python2-scipy-debuginfoUpgrade fence-agents-wtiUpgrade fence-agents-awsUpgrade python2-rpm-macrosUpgrade fence-agents-drac5Upgrade python2-psycopg2-testsUpgrade python2-attrsUpgrade fence-agents-ifmibUpgrade python2-psycopg2-debugUpgrade python2-idnaUpgrade python2-pysocksUpgrade python2-wheel-wheelUpgrade fence-virtd-multicast-debuginfoUpgrade python2-setuptools_scmUpgrade python2-bsonUpgrade python2-sqlalchemyUpgrade fence-agents-debugsourceUpgrade fence-agents-ilo-sshUpgrade python2-markupsafeUpgrade ha-openstack-supportUpgrade python2-numpy-docUpgrade python2-pytzUpgrade python2-virtualenvUpgrade python2-pytestUpgrade fence-virtd-serialUpgrade fence-agents-brocadeUpgrade fence-agents-kdump-debuginfoUpgrade python2Upgrade fence-agents-ilo2Upgrade fence-agents-ibm-vpcUpgrade python-psycopg2-debugsourceUpgrade python2-pymongoUpgrade python2-setuptoolsUpgrade python2-urllib3Upgrade fence-agents-cisco-ucsUpgrade fence-virtUpgrade fence-agents-gceUpgrade fence-agents-zvmUpgrade python2-backportsUpgrade python2-lxmlUpgrade python2-testUpgrade fence-agents-vmware-restUpgrade python2-CythonUpgrade python2-pipUpgrade python2-noseUpgrade fence-virtd-debuginfoUpgrade python2-docutilsUpgrade python2-pyyamlUpgrade fence-agents-kdumpUpgrade ha-openstack-support-debuginfoUpgrade fence-agents-rsaUpgrade fence-agents-virshUpgrade babelUpgrade python2-babelUpgrade fence-agents-apc-snmpUpgrade ha-cloud-support-debuginfoUpgrade python2-lxml-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-docsUpgrade fence-agents-debuginfoUpgrade python2-bson-debuginfoUpgrade fence-agents-rhevmUpgrade fence-agents-heuristics-pingUpgrade fence-agents-cisco-mdsUpgrade fence-agents-amt-wsUpgrade python2-psycopg2-debug-debuginfoUpgrade PyYAML-debugsourceUpgrade python2-toolsUpgrade fence-agents-scsiUpgrade python2-psycopg2Upgrade python2-develUpgrade python2-Cython-debuginfoUpgrade python2-docs-infoUpgrade python-nose-docsUpgrade fence-virtd-cpgUpgrade fence-agents-commonUpgrade fence-virtd-cpg-debuginfoUpgrade python-coverage-debugsourceUpgrade python-pymongo-debuginfoUpgrade fence-agents-rsbUpgrade python2-scipyUpgrade python2-debugsourceUpgrade python2-coverageUpgrade fence-agents-ipduUpgrade fence-virtdUpgrade fence-agents-emersonUpgrade fence-agents-azure-armUpgrade python2-pytest-mockUpgrade fence-agents-ibm-powervsUpgrade Cython-debugsourceUpgrade python2-numpy-f2pyUpgrade fence-agents-redfishUpgrade ha-cloud-supportUpgrade fence-agents-intelmodularUpgrade python2-setuptools-wheelUpgrade fence-agents-mpathUpgrade fence-agents-kubevirtUpgrade python2-numpyUpgrade fence-agents-ilo-mpUpgrade python-lxml-debugsourceUpgrade python2-wheelUpgrade fence-agents-sbdUpgrade fence-agents-computeUpgrade python2-ipaddressUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-tcpUpgrade python2-pip-wheelUpgrade fence-agents-allUpgrade python2-pyUpgrade python2-libsUpgrade python2-pymongo-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-ibmbladeUpgrade python2-PyMySQLUpgrade fence-agents-bladecenterUpgrade python2-sixUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-epsUpgrade fence-agents-vmware-soapUpgrade fence-virt-debuginfoUpgrade python-psycopg2-debuginfoUpgrade fence-virtd-libvirtUpgrade python2-chardetUpgrade python2-debugUpgrade fence-agents-aliyun | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade python-pymongo-debuginfoUpgrade python2-scipyUpgrade python2-tkinterUpgrade python2-debugsourceUpgrade python2-markupsafeUpgrade python2-sqlalchemyUpgrade python2-libsUpgrade python2-scipy-debuginfoUpgrade python2-toolsUpgrade python2-pymongo-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-numpy-debuginfoUpgrade fence-agents-redfishUpgrade python2-backportsUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-pymongoUpgrade fence-agents-kdump-debuginfoUpgrade python2-bson-debuginfoUpgrade python2-coverageUpgrade python2-lxmlUpgrade python2-debugUpgrade python2-pyyaml-debuginfoUpgrade python2-numpyUpgrade python2-CythonUpgrade python2-develUpgrade fence-agents-allUpgrade python2-testUpgrade python-psycopg2-debugsourceUpgrade python-lxml-debugsourceUpgrade fence-agents-kubevirtUpgrade PyYAML-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2-testsUpgrade python2-coverage-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-psycopg2-debugUpgrade fence-agents-debuginfoUpgrade fence-agents-aliyun-debuginfoUpgrade scipy-debugsourceUpgrade python2-psycopg2Upgrade python-psycopg2-docUpgrade numpy-debugsourceUpgrade python2-Cython-debuginfoUpgrade python2-bsonUpgrade python2-psycopg2-debuginfoUpgrade python2-numpy-f2pyUpgrade fence-agents-debugsourceUpgrade python2Upgrade python-psycopg2-debuginfoUpgrade python2-debuginfoUpgrade fence-agents-kdumpUpgrade python-pymongo-debugsourceUpgrade python2-pyyamlUpgrade python2-lxml-debuginfoUpgrade fence-agents-openstackUpgrade fence-agents-aliyunUpgrade Cython-debugsource | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python313-Jinja2Upgrade python-Jinja2-emacsUpgrade python311-Jinja2Upgrade python-Jinja2-vimUpgrade python3-Jinja2 | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python-jinja2 (Ubuntu Pro)Upgrade python3-jinja2Upgrade python-jinja2Upgrade python3-jinja2 (Ubuntu Pro) | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub