Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-idnaUpgrade python2-pymongo-gridfsUpgrade fence-virtd-multicastUpgrade fence-agents-drac5Upgrade python2-jinja2Upgrade fence-agents-hpbladeUpgrade python2-backportsUpgrade fence-agents-vmware-restUpgrade python3-jinja2Upgrade fence-agents-zvmUpgrade python2-markupsafeUpgrade fence-agents-openstackUpgrade fence-agents-ifmibUpgrade fence-agents-apc-snmpUpgrade python2-pymongoUpgrade python2-docs-infoUpgrade fence-agents-lparUpgrade python2-wheel-wheelUpgrade python2-lxmlUpgrade python2-pygmentsUpgrade fence-agents-eaton-snmpUpgrade fence-agents-mpathUpgrade python2-chardetUpgrade fence-virtUpgrade fence-virtd-serialUpgrade python2-tkinterUpgrade python2-pysocksUpgrade fence-agents-epsUpgrade fence-agents-ilo-moonshotUpgrade python2-babelUpgrade ha-cloud-supportUpgrade fence-agents-rhevmUpgrade python-psycopg2-docUpgrade fence-agents-scsiUpgrade python2-backports-ssl_match_hostnameUpgrade python-nose-docsUpgrade python2-urllib3Upgrade python2-pyUpgrade python2-pipUpgrade python2-pytzUpgrade python2-requestsUpgrade python2-sixUpgrade fence-agents-ilo-mpUpgrade fence-agents-ipduUpgrade python2-numpyUpgrade fence-agents-aliyunUpgrade fence-agents-rsbUpgrade fence-agents-apcUpgrade python2-testUpgrade python2-pip-wheelUpgrade fence-agents-wtiUpgrade fence-agents-intelmodularUpgrade fence-agents-commonUpgrade python2Upgrade python2-numpy-f2pyUpgrade fence-agents-ilo-sshUpgrade python2-setuptools-wheelUpgrade python2-pluggyUpgrade python2-virtualenvUpgrade fence-agents-ilo2Upgrade python2-noseUpgrade fence-agents-azure-armUpgrade fence-virtd-tcpUpgrade fence-agents-kdumpUpgrade python2-coverageUpgrade fence-agents-rsaUpgrade python2-bsonUpgrade python2-PyMySQLUpgrade fence-agents-heuristics-pingUpgrade python2-attrsUpgrade python2-develUpgrade python2-libsUpgrade fence-agents-ibm-vpcUpgrade python2-funcsigsUpgrade python2-pytest-mockUpgrade fence-agents-virshUpgrade fence-agents-ibm-powervsUpgrade python2-psycopg2Upgrade fence-agents-emersonUpgrade python2-psycopg2-testsUpgrade python2-docsUpgrade python2-scipyUpgrade fence-agents-kubevirtUpgrade fence-agents-redfishUpgrade fence-virtdUpgrade fence-agents-ipmilanUpgrade fence-agents-sbdUpgrade babelUpgrade python2-ipaddressUpgrade fence-agents-ibmbladeUpgrade python2-wheelUpgrade python2-rpm-macrosUpgrade fence-agents-awsUpgrade fence-agents-bladecenterUpgrade python2-dnsUpgrade python2-pyyamlUpgrade fence-agents-computeUpgrade python-sqlalchemy-docUpgrade fence-agents-vmware-soapUpgrade python2-pytestUpgrade fence-agents-allUpgrade fence-agents-brocadeUpgrade python2-debugUpgrade fence-agents-amt-wsUpgrade python2-toolsUpgrade python2-setuptoolsUpgrade python2-psycopg2-debugUpgrade python2-setuptools_scmUpgrade fence-virtd-cpgUpgrade python2-sqlalchemyUpgrade fence-virtd-libvirtUpgrade fence-agents-cisco-mdsUpgrade python2-docutilsUpgrade fence-agents-cisco-ucsUpgrade python2-CythonUpgrade python2-mockUpgrade python2-numpy-docUpgrade fence-agents-gce | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python3-jinja2Upgrade python-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-jinja2Upgrade python3-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade fence-agents-allUpgrade fence-agents-intelmodularUpgrade fence-agents-heuristics-pingUpgrade python2-psycopg2Upgrade python2-docsUpgrade python2-setuptools-wheelUpgrade python2-sqlalchemyUpgrade fence-agents-ipmilanUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo-mpUpgrade fence-agents-ipduUpgrade fence-agents-rsbUpgrade fence-agents-ibm-powervsUpgrade python2-CythonUpgrade fence-virtd-cpgUpgrade fence-agents-computeUpgrade fence-agents-emersonUpgrade fence-agents-kdumpUpgrade python2-bsonUpgrade python2-libsUpgrade python2-babelUpgrade python2-pip-wheelUpgrade python2-noseUpgrade fence-agents-sbdUpgrade fence-agents-scsiUpgrade fence-agents-ibmbladeUpgrade fence-virtdUpgrade python2-coverageUpgrade fence-agents-rsaUpgrade fence-agents-virshUpgrade fence-agents-drac5Upgrade python2-numpyUpgrade python2-virtualenvUpgrade fence-agents-bladecenterUpgrade fence-agents-cisco-mdsUpgrade python2-docs-infoUpgrade python2-ipaddressUpgrade python2-develUpgrade python2-debugUpgrade python2-PyMySQLUpgrade babelUpgrade fence-agents-redfishUpgrade python2-scipyUpgrade python2-pipUpgrade python2-dnsUpgrade python2-docutilsUpgrade python-nose-docsUpgrade python2-pytest-mockUpgrade fence-virtd-tcpUpgrade fence-agents-ilo2Upgrade fence-agents-mpathUpgrade fence-agents-amt-wsUpgrade python2-toolsUpgrade python2-pyUpgrade python2-pytestUpgrade python2-funcsigsUpgrade fence-agents-rhevmUpgrade fence-agents-vmware-soapUpgrade python2-pyyamlUpgrade fence-agents-ilo-sshUpgrade python2-attrsUpgrade fence-virtUpgrade python2-idnaUpgrade fence-virtd-multicastUpgrade python2-jinja2Upgrade fence-agents-apcUpgrade fence-agents-vmware-restUpgrade fence-agents-commonUpgrade fence-agents-apc-snmpUpgrade python2-pluggyUpgrade fence-agents-ibm-vpcUpgrade python2-numpy-f2pyUpgrade fence-agents-lparUpgrade python2-testUpgrade python2-pysocksUpgrade python2-psycopg2-testsUpgrade python-sqlalchemy-docUpgrade python-psycopg2-docUpgrade fence-virtd-libvirtUpgrade fence-agents-brocadeUpgrade python2-wheel-wheelUpgrade python2-mockUpgrade python2-lxmlUpgrade fence-agents-wtiUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-ucsUpgrade python3-jinja2Upgrade python2-pygmentsUpgrade python2-markupsafeUpgrade fence-virtd-serialUpgrade python2-setuptoolsUpgrade python2-urllib3Upgrade fence-agents-ifmibUpgrade fence-agents-eaton-snmpUpgrade python2-wheelUpgrade python2Upgrade python2-pymongoUpgrade fence-agents-hpbladeUpgrade python2-backportsUpgrade fence-agents-epsUpgrade python2-chardetUpgrade python2-backports-ssl_match_hostnameUpgrade python2-sixUpgrade python2-setuptools_scmUpgrade python2-requestsUpgrade python2-pymongo-gridfsUpgrade python2-pytzUpgrade python2-numpy-docUpgrade python2-psycopg2-debugUpgrade python2-tkinterUpgrade python2-rpm-macros | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade fence-agents-vmware-restUpgrade fence-agents-gceUpgrade fence-agents-ibm-vpcUpgrade python2Upgrade python2-requestsUpgrade python2-psycopg2-testsUpgrade python2-pyyaml-debuginfoUpgrade fence-agents-ifmibUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-ipmilanUpgrade python2-attrsUpgrade python2-psycopg2-debuginfoUpgrade python-psycopg2-debugsourceUpgrade fence-virtd-serialUpgrade fence-agents-debugsourceUpgrade python2-bsonUpgrade python2-markupsafeUpgrade fence-virtd-multicast-debuginfoUpgrade ha-openstack-supportUpgrade python2-idnaUpgrade python2-psycopg2-debugUpgrade fence-agents-ilo2Upgrade python2-numpy-docUpgrade fence-agents-hpbladeUpgrade python2-pluggyUpgrade python2-pymongoNo solution existsUpgrade python2-setuptoolsUpgrade python2-urllib3Upgrade fence-agents-cisco-ucsUpgrade python2-funcsigsUpgrade python2-jinja2Upgrade fence-virtd-tcp-debuginfoUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pymongo-gridfsUpgrade fence-agents-wtiUpgrade fence-agents-awsUpgrade fence-agents-drac5Upgrade fence-agents-ilo-sshUpgrade python-sqlalchemy-docUpgrade python2-pysocksUpgrade python2-pygmentsUpgrade python2-setuptools_scmUpgrade python2-sqlalchemyUpgrade python3-jinja2Upgrade python-psycopg2-docUpgrade fence-virtUpgrade python2-wheel-wheelUpgrade fence-agents-apcUpgrade python2-lxmlUpgrade scipy-debugsourceUpgrade python2-rpm-macrosUpgrade python2-scipy-debuginfoUpgrade python2-testUpgrade python2-virtualenvUpgrade python2-pytestUpgrade fence-agents-zvmUpgrade python2-dnsUpgrade fence-agents-lparUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-multicastUpgrade fence-agents-openstackUpgrade numpy-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-tkinterUpgrade python2-mockUpgrade python2-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-pytzUpgrade python2-backportsUpgrade fence-agents-brocadeUpgrade fence-agents-kdump-debuginfoUpgrade python2-bson-debuginfoUpgrade python2-docutilsUpgrade python-lxml-debugsourceUpgrade fence-virtd-debuginfoUpgrade ha-cloud-supportUpgrade python2-Cython-debuginfoUpgrade python2-numpy-debuginfoUpgrade fence-virtd-cpgUpgrade fence-agents-allUpgrade fence-agents-kdumpUpgrade python2-pymongo-debuginfoUpgrade python-nose-docsUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-kubevirtUpgrade fence-agents-apc-snmpUpgrade babelUpgrade fence-agents-virshUpgrade python2-pyyamlUpgrade python2-debugUpgrade python2-pipUpgrade python2-chardetUpgrade fence-agents-vmware-soapUpgrade python2-setuptools-wheelUpgrade python2-develUpgrade fence-agents-mpathUpgrade fence-agents-redfishUpgrade fence-agents-sbdUpgrade python2-numpy-f2pyUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ilo-mpUpgrade fence-agents-rsaUpgrade python2-psycopg2Upgrade python2-PyMySQLUpgrade fence-agents-azure-armUpgrade fence-agents-scsiUpgrade PyYAML-debugsourceUpgrade fence-agents-rhevmUpgrade python2-toolsUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-noseUpgrade fence-agents-heuristics-pingUpgrade fence-agents-cisco-mdsUpgrade fence-agents-amt-wsUpgrade python2-debugsourceUpgrade fence-agents-emersonUpgrade python2-pytest-mockUpgrade fence-agents-rsbUpgrade fence-agents-ibmbladeUpgrade fence-virtdUpgrade fence-agents-intelmodularUpgrade python2-ipaddressUpgrade python2-numpyUpgrade Cython-debugsourceUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-ipduUpgrade python2-scipyUpgrade python2-coverageUpgrade fence-agents-debuginfoUpgrade fence-virtd-libvirtUpgrade fence-virt-debuginfoUpgrade fence-agents-aliyunUpgrade python-psycopg2-debuginfoUpgrade fence-agents-computeUpgrade python2-wheelUpgrade python2-CythonUpgrade fence-agents-bladecenterUpgrade python2-pip-wheelUpgrade python2-sixUpgrade python2-libsUpgrade ha-openstack-support-debuginfoUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-epsUpgrade fence-virtd-tcpUpgrade fence-agents-aliyun-debuginfoUpgrade python2-babelUpgrade python2-pyUpgrade python2-docs-infoUpgrade python-pymongo-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-commonUpgrade python-coverage-debugsourceUpgrade python2-lxml-debuginfoUpgrade python2-docs | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade python2-CythonUpgrade python2-develUpgrade fence-agents-allUpgrade python2-lxmlUpgrade python-pymongo-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-libsUpgrade python2-numpyUpgrade python2-tkinterUpgrade python2-debugUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-pymongo-debuginfoUpgrade python2-pymongoUpgrade python2-toolsUpgrade python2-debugsourceUpgrade python2-sqlalchemyUpgrade python2-coverageUpgrade python2-markupsafeUpgrade python2-scipyUpgrade fence-agents-kdump-debuginfoUpgrade python2-bson-debuginfoUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-redfishUpgrade python2-backportsUpgrade python2-scipy-debuginfoUpgrade fence-agents-kdumpUpgrade python2-testUpgrade python2-bsonUpgrade fence-agents-aliyunUpgrade python2Upgrade python-psycopg2-debuginfoUpgrade fence-agents-debugsourceUpgrade python2-psycopg2-debuginfoUpgrade Cython-debugsourceUpgrade python2-pyyamlUpgrade fence-agents-openstackUpgrade fence-agents-debuginfoUpgrade python2-psycopg2-debugUpgrade python-coverage-debugsourceUpgrade python-psycopg2-debugsourceUpgrade fence-agents-kubevirtUpgrade python2-debuginfoUpgrade PyYAML-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-psycopg2Upgrade python2-pymongo-gridfsUpgrade python-lxml-debugsourceUpgrade python2-psycopg2-testsUpgrade python2-numpy-f2pyUpgrade python2-lxml-debuginfoUpgrade python2-Cython-debuginfoUpgrade python-psycopg2-docUpgrade numpy-debugsourceUpgrade fence-agents-aliyun-debuginfoUpgrade scipy-debugsourceUpgrade python-pymongo-debugsource | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python-Jinja2-emacsUpgrade python311-Jinja2Upgrade python313-Jinja2Upgrade python-Jinja2-vimUpgrade python3-Jinja2 | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python3-jinja2Upgrade python-jinja2Upgrade python-jinja2 (Ubuntu Pro) | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub