Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-numpy-f2pyUpgrade python2-urllib3Upgrade fence-agents-mpathUpgrade fence-agents-ilo-mpUpgrade python2-jinja2Upgrade python2-idnaUpgrade fence-virtUpgrade python3-jinja2Upgrade fence-virtd-multicastUpgrade python-psycopg2-docUpgrade python2-setuptools-wheelUpgrade fence-agents-aliyunUpgrade python2-chardetUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-lparUpgrade ha-cloud-supportUpgrade python2-pluggyUpgrade fence-agents-ilo-sshUpgrade fence-agents-eaton-snmpUpgrade python2-pip-wheelUpgrade python2-testUpgrade python2-tkinterUpgrade python2-docs-infoUpgrade fence-agents-drac5Upgrade python2-pytzUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pymongo-gridfsUpgrade fence-agents-intelmodularUpgrade python2Upgrade python2-backportsUpgrade python2-wheel-wheelUpgrade python-nose-docsUpgrade python2-markupsafeUpgrade fence-agents-commonUpgrade python2-pygmentsUpgrade python2-pipUpgrade fence-agents-epsUpgrade python2-requestsUpgrade python2-pymongoUpgrade fence-agents-vmware-restUpgrade fence-agents-ipduUpgrade python2-babelUpgrade fence-agents-hpbladeUpgrade fence-agents-openstackUpgrade fence-virtd-serialUpgrade fence-agents-ifmibUpgrade python2-pysocksUpgrade python2-pyUpgrade fence-agents-apcUpgrade fence-agents-rhevmUpgrade fence-agents-scsiUpgrade python2-lxmlUpgrade fence-agents-apc-snmpUpgrade python2-numpyUpgrade fence-agents-wtiUpgrade fence-agents-rsbUpgrade fence-agents-zvmUpgrade python2-sixUpgrade fence-agents-emersonUpgrade fence-agents-virshUpgrade python2-wheelUpgrade fence-agents-ibm-powervsUpgrade fence-agents-awsUpgrade python2-docutilsUpgrade fence-agents-ibmbladeUpgrade python2-dnsUpgrade fence-virtdUpgrade python2-ipaddressUpgrade python2-docsUpgrade python2-sqlalchemyUpgrade python2-pytest-mockUpgrade fence-agents-redfishUpgrade fence-agents-azure-armUpgrade fence-agents-ibm-vpcUpgrade fence-agents-heuristics-pingUpgrade fence-agents-amt-wsUpgrade fence-agents-kubevirtUpgrade python2-pytestUpgrade python2-psycopg2Upgrade python2-funcsigsUpgrade python2-develUpgrade fence-agents-ipmilanUpgrade fence-agents-vmware-soapUpgrade python-sqlalchemy-docUpgrade fence-agents-kdumpUpgrade python2-setuptools_scmUpgrade fence-agents-cisco-mdsUpgrade python2-bsonUpgrade python2-attrsUpgrade python2-noseUpgrade fence-agents-gceUpgrade fence-virtd-libvirtUpgrade python2-pyyamlUpgrade fence-agents-cisco-ucsUpgrade python2-CythonUpgrade fence-virtd-cpgUpgrade fence-agents-allUpgrade babelUpgrade python2-coverageUpgrade fence-agents-brocadeUpgrade fence-virtd-tcpUpgrade fence-agents-bladecenterUpgrade python2-PyMySQLUpgrade fence-agents-rsaUpgrade python2-psycopg2-debugUpgrade python2-virtualenvUpgrade python2-psycopg2-testsUpgrade fence-agents-computeUpgrade python2-debugUpgrade fence-agents-ilo2Upgrade python2-mockUpgrade python2-scipyUpgrade python2-toolsUpgrade python2-setuptoolsUpgrade python2-libsUpgrade python2-numpy-docUpgrade fence-agents-sbdUpgrade python2-rpm-macros | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-jinja2Upgrade python3-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-jinja2Upgrade python2-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade fence-agents-amt-wsUpgrade fence-agents-mpathUpgrade python2-psycopg2Upgrade python-nose-docsUpgrade python2-coverageUpgrade python2-docutilsUpgrade python2-dnsUpgrade fence-agents-allUpgrade python2-sqlalchemyUpgrade python2-toolsUpgrade python2-setuptools-wheelUpgrade python2-debugUpgrade python2-funcsigsUpgrade python2-ipaddressUpgrade fence-agents-ilo-mpUpgrade python2-CythonUpgrade fence-agents-kdumpUpgrade python2-pyUpgrade python2-pytest-mockUpgrade python2-pytestUpgrade fence-agents-kubevirtUpgrade python2-pip-wheelUpgrade fence-agents-ipmilanUpgrade fence-virtdUpgrade fence-agents-heuristics-pingUpgrade fence-agents-intelmodularUpgrade python2-docsUpgrade fence-virtd-cpgUpgrade python2-PyMySQLUpgrade fence-agents-rsbUpgrade fence-agents-virshUpgrade fence-agents-computeUpgrade python2-numpyUpgrade python2-scipyUpgrade fence-agents-emersonUpgrade python2-bsonUpgrade fence-agents-cisco-mdsUpgrade fence-agents-drac5Upgrade fence-agents-bladecenterUpgrade fence-agents-rsaUpgrade python2-babelUpgrade python2-noseUpgrade python2-virtualenvUpgrade python2-develUpgrade fence-agents-rhevmUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ipduUpgrade fence-agents-sbdUpgrade fence-virtd-tcpUpgrade fence-agents-scsiUpgrade python2-docs-infoUpgrade babelUpgrade python2-libsUpgrade fence-agents-ibmbladeUpgrade fence-agents-ilo2Upgrade fence-agents-redfishUpgrade fence-agents-vmware-soapUpgrade python2-pipUpgrade python2-pyyamlUpgrade fence-agents-lparUpgrade fence-agents-ibm-vpcUpgrade fence-virtd-libvirtUpgrade python2-attrsUpgrade fence-agents-vmware-restUpgrade fence-virtUpgrade python2-psycopg2-debugUpgrade python2-numpy-docUpgrade fence-virtd-serialUpgrade python2-setuptoolsUpgrade fence-agents-ifmibUpgrade python2-urllib3Upgrade fence-agents-eaton-snmpUpgrade fence-agents-hpbladeUpgrade fence-agents-commonUpgrade fence-agents-apc-snmpUpgrade python2-pluggyUpgrade python2-numpy-f2pyUpgrade python2-pymongo-gridfsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-sixUpgrade python2-chardetUpgrade fence-agents-epsUpgrade python2-requestsUpgrade python2-setuptools_scmUpgrade python2-backportsUpgrade python2-pymongoUpgrade python2Upgrade python2-wheelUpgrade python2-pytzUpgrade fence-virtd-multicastUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-ucsUpgrade fence-agents-wtiUpgrade python3-jinja2Upgrade python2-pygmentsUpgrade python2-lxmlUpgrade python2-mockUpgrade fence-agents-brocadeUpgrade python2-wheel-wheelUpgrade python2-testUpgrade python2-pysocksUpgrade python2-psycopg2-testsUpgrade python-sqlalchemy-docUpgrade python-psycopg2-docUpgrade python2-tkinterUpgrade python2-rpm-macrosUpgrade fence-agents-apcUpgrade python2-markupsafeUpgrade python2-idnaUpgrade fence-agents-ilo-sshUpgrade python2-jinja2 | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade fence-agents-azure-armUpgrade python2-docs-infoUpgrade fence-virtd-cpgUpgrade fence-virtd-cpg-debuginfoUpgrade python-coverage-debugsourceUpgrade python-nose-docsUpgrade python2-lxml-debuginfoUpgrade python2-docsUpgrade python2-bson-debuginfoUpgrade python2-scipyUpgrade python2-pytest-mockUpgrade fence-agents-ibmbladeUpgrade fence-virtdUpgrade fence-agents-emersonUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-rsbUpgrade python2-coverageUpgrade python2-PyMySQLUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-ipduUpgrade python2-libsUpgrade python2-debugsourceUpgrade python2-pip-wheelUpgrade python2-pyUpgrade python2-pymongo-debuginfoUpgrade python2-babelUpgrade fence-agents-kdumpUpgrade fence-agents-aliyun-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-allUpgrade ha-openstack-support-debuginfoUpgrade fence-agents-epsUpgrade fence-agents-redfishUpgrade babelUpgrade fence-agents-intelmodularUpgrade fence-agents-vmware-soapUpgrade fence-agents-kubevirtUpgrade python2-chardetUpgrade fence-agents-apc-snmpUpgrade python-pymongo-debuginfoUpgrade fence-agents-commonUpgrade python2-debugUpgrade python2-pyyamlUpgrade python2-pipUpgrade python2-docutilsUpgrade python-lxml-debugsourceUpgrade ha-cloud-support-debuginfoUpgrade python2-setuptools-wheelUpgrade python2-numpyUpgrade python2-psycopg2Upgrade PyYAML-debugsourceUpgrade fence-agents-cisco-mdsUpgrade python2-numpy-f2pyUpgrade python2-toolsUpgrade fence-agents-scsiUpgrade python2-psycopg2-debug-debuginfoUpgrade fence-agents-rhevmUpgrade fence-agents-virshUpgrade fence-agents-ibm-powervsUpgrade python2-ipaddressUpgrade fence-agents-sbdUpgrade python2-Cython-debuginfoUpgrade Cython-debugsourceUpgrade fence-agents-mpathUpgrade fence-agents-ilo-mpUpgrade fence-agents-rsaUpgrade ha-cloud-supportUpgrade python2-noseUpgrade python2-sixUpgrade fence-agents-heuristics-pingUpgrade python2-develUpgrade fence-virtd-debuginfoUpgrade python2-numpy-debuginfoUpgrade fence-agents-aliyunUpgrade fence-agents-debuginfoUpgrade fence-virt-debuginfoUpgrade python2-CythonUpgrade python2-wheelUpgrade python-psycopg2-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-agents-computeUpgrade fence-agents-bladecenterUpgrade fence-agents-amt-wsNo solution existsUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-agents-ipmilanUpgrade ha-openstack-supportUpgrade python2-scipy-debuginfoUpgrade python2-lxmlUpgrade python2-backportsUpgrade fence-agents-vmware-restUpgrade fence-agents-zvmUpgrade fence-agents-gceUpgrade scipy-debugsourceUpgrade python2-testUpgrade fence-agents-awsUpgrade python2-setuptools_scmUpgrade python2-coverage-debuginfoUpgrade python2-pymongoUpgrade fence-agents-lparUpgrade python-psycopg2-docUpgrade python2-sqlalchemyUpgrade python2-wheel-wheelUpgrade python2-pygmentsUpgrade fence-virtd-serialUpgrade python-sqlalchemy-docUpgrade python2-psycopg2-debugUpgrade fence-virtUpgrade fence-agents-hpbladeUpgrade python2-backports-ssl_match_hostnameUpgrade fence-virtd-tcp-debuginfoUpgrade python2-bsonUpgrade python2-pysocksUpgrade fence-agents-debugsourceUpgrade fence-agents-wtiUpgrade fence-agents-ilo-sshUpgrade fence-agents-drac5Upgrade python2-funcsigsUpgrade python2-jinja2Upgrade python2-pymongo-gridfsUpgrade python2-virtualenvUpgrade python2-psycopg2-testsUpgrade fence-agents-ilo2Upgrade python2-pytzUpgrade python2-numpy-docUpgrade fence-agents-kdump-debuginfoUpgrade python2Upgrade fence-agents-openstackUpgrade python-pymongo-debugsourceUpgrade fence-agents-ilo-moonshotUpgrade python2-pytestUpgrade python2-setuptoolsUpgrade python2-pluggyUpgrade fence-agents-cisco-ucsUpgrade python2-urllib3Upgrade python2-tkinterUpgrade python3-jinja2Upgrade python2-dnsUpgrade python2-attrsUpgrade python2-requestsUpgrade python2-pyyaml-debuginfoUpgrade fence-agents-ifmibUpgrade fence-agents-eaton-snmpUpgrade python2-psycopg2-debuginfoUpgrade python2-mockUpgrade python-psycopg2-debugsourceUpgrade numpy-debugsourceUpgrade fence-agents-brocadeUpgrade fence-virtd-multicastUpgrade fence-agents-ibm-vpcUpgrade python2-rpm-macrosUpgrade python2-markupsafeUpgrade python2-debuginfoUpgrade fence-agents-apcUpgrade fence-virtd-multicast-debuginfoUpgrade python2-idna | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade fence-agents-aliyunUpgrade python-psycopg2-docUpgrade python2-bsonUpgrade python2-Cython-debuginfoUpgrade python2-testUpgrade fence-agents-openstackUpgrade python2Upgrade python2-numpy-f2pyUpgrade python2-psycopg2-debuginfoUpgrade python2-lxml-debuginfoUpgrade fence-agents-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-pyyamlUpgrade Cython-debugsourceUpgrade fence-agents-aliyun-debuginfoUpgrade python2-psycopg2-debugUpgrade fence-agents-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-pymongo-gridfsUpgrade PyYAML-debugsourceUpgrade python2-debuginfoUpgrade fence-agents-kubevirtUpgrade scipy-debugsourceUpgrade python2-psycopg2Upgrade numpy-debugsourceUpgrade python-lxml-debugsourceUpgrade python-psycopg2-debugsourceUpgrade fence-agents-kdumpUpgrade python-pymongo-debugsourceUpgrade python2-toolsUpgrade python2-markupsafeUpgrade python2-debugUpgrade python2-numpyUpgrade python2-pymongo-debuginfoUpgrade python2-libsUpgrade python2-debugsourceUpgrade python2-backportsUpgrade fence-agents-redfishUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-sqlalchemyUpgrade python2-bson-debuginfoUpgrade python2-tkinterUpgrade python-pymongo-debuginfoUpgrade python2-pymongoUpgrade fence-agents-kdump-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-develUpgrade python2-lxmlUpgrade python2-CythonUpgrade fence-agents-allUpgrade python2-pyyaml-debuginfoUpgrade python2-coverageUpgrade python2-scipy-debuginfoUpgrade python2-scipy | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python311-Jinja2Upgrade python-Jinja2-emacsUpgrade python-Jinja2-vimUpgrade python313-Jinja2Upgrade python3-Jinja2 | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python-jinja2Upgrade python-jinja2 (Ubuntu Pro)Upgrade python3-jinja2 | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub