Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-rsbUpgrade python2Upgrade fence-agents-zvmUpgrade fence-agents-intelmodularUpgrade python2-docs-infoUpgrade python2-pymongo-gridfsUpgrade fence-agents-hpbladeUpgrade python2-pyUpgrade fence-virtd-serialUpgrade python2-setuptools-wheelUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-aliyunUpgrade python2-pip-wheelUpgrade fence-agents-apcUpgrade fence-virtd-multicastUpgrade python-nose-docsUpgrade python2-urllib3Upgrade python2-pluggyUpgrade python2-numpy-f2pyUpgrade python2-pytzUpgrade fence-agents-ifmibUpgrade fence-agents-mpathUpgrade python2-markupsafeUpgrade fence-agents-scsiUpgrade fence-agents-openstackUpgrade python2-backportsUpgrade ha-cloud-supportUpgrade fence-agents-lparUpgrade python2-backports-ssl_match_hostnameUpgrade fence-agents-ilo-sshUpgrade python3-jinja2Upgrade python2-tkinterUpgrade python2-babelUpgrade fence-agents-drac5Upgrade fence-virtUpgrade python2-numpyUpgrade python2-wheel-wheelUpgrade fence-agents-ipduUpgrade python2-requestsUpgrade fence-agents-commonUpgrade python2-pipUpgrade python2-pygmentsUpgrade fence-agents-apc-snmpUpgrade fence-agents-epsUpgrade python2-pysocksUpgrade python2-jinja2Upgrade python2-idnaUpgrade python2-pymongoUpgrade python2-sixUpgrade fence-agents-eaton-snmpUpgrade python2-chardetUpgrade fence-agents-rhevmUpgrade python2-lxmlUpgrade fence-agents-vmware-restUpgrade fence-agents-ilo-mpUpgrade fence-agents-wtiUpgrade python-psycopg2-docUpgrade python2-testUpgrade fence-agents-computeUpgrade fence-agents-kdumpUpgrade python2-libsUpgrade python2-develUpgrade python-sqlalchemy-docUpgrade python2-mockUpgrade python2-noseUpgrade python2-pytestUpgrade python2-scipyUpgrade python2-pyyamlUpgrade fence-agents-redfishUpgrade python2-psycopg2Upgrade python2-psycopg2-testsUpgrade python2-bsonUpgrade fence-agents-awsUpgrade fence-agents-sbdUpgrade fence-agents-ipmilanUpgrade python2-dnsUpgrade python2-rpm-macrosUpgrade fence-agents-ibmbladeUpgrade babelUpgrade python2-ipaddressUpgrade python2-wheelUpgrade fence-virtdUpgrade python2-PyMySQLUpgrade fence-virtd-tcpUpgrade fence-agents-cisco-mdsUpgrade fence-agents-rsaUpgrade python2-attrsUpgrade fence-agents-ilo2Upgrade fence-agents-azure-armUpgrade python2-virtualenvUpgrade fence-agents-amt-wsUpgrade fence-agents-ibm-powervsUpgrade python2-debugUpgrade fence-agents-bladecenterUpgrade python2-funcsigsUpgrade python2-toolsUpgrade fence-virtd-libvirtUpgrade fence-agents-emersonUpgrade python2-setuptools_scmUpgrade python2-pytest-mockUpgrade fence-agents-gceUpgrade fence-virtd-cpgUpgrade fence-agents-virshUpgrade fence-agents-allUpgrade python2-setuptoolsUpgrade fence-agents-cisco-ucsUpgrade fence-agents-vmware-soapUpgrade python2-sqlalchemyUpgrade python2-numpy-docUpgrade python2-docutilsUpgrade python2-docsUpgrade python2-CythonUpgrade python2-psycopg2-debugUpgrade python2-coverageUpgrade fence-agents-kubevirtUpgrade fence-agents-brocadeUpgrade fence-agents-heuristics-pingUpgrade fence-agents-ibm-vpc | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python3-jinja2Upgrade python-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-jinja2Upgrade python2-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python2-pyyamlUpgrade python2-pipUpgrade python2-pytestUpgrade fence-agents-ilo-mpUpgrade fence-agents-kubevirtUpgrade fence-agents-emersonUpgrade python2-pytest-mockUpgrade python2-sqlalchemyUpgrade fence-agents-allUpgrade fence-agents-amt-wsUpgrade fence-agents-heuristics-pingUpgrade fence-agents-intelmodularUpgrade python2-setuptools-wheelUpgrade fence-agents-ipmilanUpgrade python2-psycopg2Upgrade python2-docsUpgrade fence-agents-mpathUpgrade fence-agents-rsaUpgrade fence-agents-bladecenterUpgrade python2-ipaddressUpgrade fence-agents-cisco-mdsUpgrade python2-debugUpgrade python2-funcsigsUpgrade fence-agents-vmware-soapUpgrade python2-coverageUpgrade python-nose-docsUpgrade python2-dnsUpgrade python2-docutilsUpgrade fence-agents-kdumpUpgrade python2-babelUpgrade fence-agents-ipduUpgrade fence-agents-computeUpgrade python2-PyMySQLUpgrade python2-scipyUpgrade python2-docs-infoUpgrade python2-virtualenvUpgrade fence-agents-ilo2Upgrade fence-agents-drac5Upgrade fence-agents-virshUpgrade python2-numpyUpgrade python2-pyUpgrade babelUpgrade python2-develUpgrade python2-toolsUpgrade fence-agents-ibmbladeUpgrade fence-agents-scsiUpgrade fence-virtdUpgrade python2-bsonUpgrade python2-libsUpgrade python2-pip-wheelUpgrade fence-agents-rsbUpgrade fence-agents-sbdUpgrade fence-agents-rhevmUpgrade python2-noseUpgrade fence-agents-redfishUpgrade fence-virtd-cpgUpgrade fence-virtd-tcpUpgrade python2-CythonUpgrade fence-agents-ibm-powervsUpgrade python2-numpy-f2pyUpgrade fence-agents-apc-snmpUpgrade python2-wheelUpgrade python2-pytzUpgrade fence-agents-ifmibUpgrade python2Upgrade python-sqlalchemy-docUpgrade python2-pysocksUpgrade python2-wheel-wheelUpgrade fence-virtd-libvirtUpgrade python2-psycopg2-testsUpgrade python2-setuptools_scmUpgrade python2-requestsUpgrade python2-pymongo-gridfsUpgrade python2-chardetUpgrade python2-backports-ssl_match_hostnameUpgrade fence-agents-epsUpgrade python2-sixUpgrade python3-jinja2Upgrade python2-pygmentsUpgrade python2-lxmlUpgrade fence-agents-wtiUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-ucsUpgrade python2-idnaUpgrade fence-agents-apcUpgrade fence-agents-eaton-snmpUpgrade python2-psycopg2-debugUpgrade fence-virtd-serialUpgrade python2-urllib3Upgrade python2-setuptoolsUpgrade python2-numpy-docUpgrade python2-pluggyUpgrade fence-agents-lparUpgrade fence-agents-ibm-vpcUpgrade fence-agents-commonUpgrade fence-virtd-multicastUpgrade python2-backportsUpgrade fence-agents-hpbladeUpgrade python2-pymongoUpgrade python2-rpm-macrosUpgrade python2-markupsafeUpgrade python2-jinja2Upgrade fence-virtUpgrade fence-agents-vmware-restUpgrade python2-tkinterUpgrade python2-attrsUpgrade fence-agents-ilo-sshUpgrade python2-testUpgrade python2-mockUpgrade python-psycopg2-docUpgrade fence-agents-brocade | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade python2-backportsUpgrade python2-pytestUpgrade fence-agents-kdump-debuginfoUpgrade python2-backports-ssl_match_hostnameUpgrade fence-agents-ilo2Upgrade python2Upgrade fence-virtd-serialUpgrade fence-agents-brocadeUpgrade python2-virtualenvUpgrade python2-numpy-docUpgrade fence-agents-gceUpgrade python-pymongo-debugsourceUpgrade fence-agents-zvmUpgrade python2-lxmlUpgrade python3-jinja2Upgrade python2-urllib3Upgrade python2-mockUpgrade python2-dnsUpgrade fence-agents-awsUpgrade fence-agents-wtiUpgrade python2-coverage-debuginfoUpgrade python2-tkinterUpgrade fence-virtd-multicastUpgrade python2-setuptools_scmUpgrade python2-debuginfoUpgrade fence-agents-openstackUpgrade numpy-debugsourceUpgrade python2-sqlalchemyUpgrade ha-openstack-supportUpgrade python2-idnaUpgrade fence-agents-apcUpgrade fence-agents-lparUpgrade python2-pytzUpgrade python2-wheel-wheelUpgrade fence-virtd-tcp-debuginfoUpgrade python2-pymongoUpgrade fence-agents-drac5Upgrade python2-bsonUpgrade python2-pymongo-gridfsUpgrade fence-agents-debugsourceUpgrade python2-pygmentsUpgrade python2-pluggyUpgrade fence-virtUpgrade fence-agents-cisco-ucsUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade scipy-debugsourceUpgrade python-psycopg2-debugsourceUpgrade fence-agents-ibm-vpcUpgrade python2-rpm-macrosUpgrade python2-jinja2Upgrade python2-funcsigsUpgrade python-psycopg2-docUpgrade fence-agents-ilo-sshUpgrade fence-agents-vmware-restUpgrade python2-psycopg2-debugUpgrade python-sqlalchemy-docUpgrade fence-agents-hpbladeNo solution existsUpgrade python2-scipy-debuginfoUpgrade python2-testUpgrade python2-markupsafeUpgrade python2-pysocksUpgrade fence-agents-ifmibUpgrade fence-agents-ipmilanUpgrade fence-agents-ilo-moonshotUpgrade python2-attrsUpgrade python2-psycopg2-testsUpgrade python2-pyyaml-debuginfoUpgrade fence-agents-eaton-snmpUpgrade python2-requestsUpgrade python2-psycopg2-debuginfoUpgrade python2-setuptoolsUpgrade fence-agents-ibm-powervsUpgrade python2-sixUpgrade ha-cloud-supportUpgrade fence-agents-redfishUpgrade fence-agents-intelmodularUpgrade python-pymongo-debuginfoUpgrade fence-virtd-cpgUpgrade python2-bson-debuginfoUpgrade python2-babelUpgrade fence-agents-allUpgrade python2-pip-wheelUpgrade python2-libsUpgrade fence-virtd-tcpUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-kdumpUpgrade fence-agents-epsUpgrade python2-pyUpgrade fence-agents-aliyun-debuginfoUpgrade python2-pymongo-debuginfoUpgrade ha-openstack-support-debuginfoUpgrade python2-psycopg2Upgrade fence-agents-ilo-mpUpgrade python2-numpyUpgrade fence-agents-sbdUpgrade fence-agents-rsaUpgrade python2-Cython-debuginfoUpgrade fence-agents-mpathUpgrade python2-scipyUpgrade python2-pytest-mockUpgrade python2-coverageUpgrade fence-agents-rsbUpgrade fence-agents-ibmbladeUpgrade fence-agents-emersonUpgrade fence-agents-azure-armUpgrade fence-virtd-cpg-debuginfoUpgrade python2-develUpgrade python2-setuptools-wheelUpgrade python2-ipaddressUpgrade python2-docsUpgrade python2-docs-infoUpgrade ha-cloud-support-debuginfoUpgrade python2-numpy-debuginfoUpgrade fence-agents-bladecenterUpgrade python2-debugUpgrade python2-pyyamlUpgrade python2-pipUpgrade fence-agents-apc-snmpUpgrade python-lxml-debugsourceUpgrade python2-chardetUpgrade python2-docutilsUpgrade fence-agents-virshUpgrade fence-agents-vmware-soapUpgrade babelUpgrade fence-virtd-debuginfoUpgrade fence-agents-kubevirtUpgrade python2-PyMySQLUpgrade python2-lxml-debuginfoUpgrade fence-agents-cisco-mdsUpgrade fence-agents-commonUpgrade fence-agents-amt-wsUpgrade PyYAML-debugsourceUpgrade python2-toolsUpgrade python2-psycopg2-debug-debuginfoUpgrade fence-agents-rhevmUpgrade fence-agents-scsiUpgrade python2-noseUpgrade fence-agents-heuristics-pingUpgrade python2-numpy-f2pyUpgrade fence-virtdUpgrade fence-agents-ipduUpgrade python2-debugsourceUpgrade fence-agents-kubevirt-debuginfoUpgrade python-nose-docsUpgrade python2-CythonUpgrade python-coverage-debugsourceUpgrade python-psycopg2-debuginfoUpgrade fence-agents-computeUpgrade fence-agents-debuginfoUpgrade fence-virt-debuginfoUpgrade fence-virtd-libvirtUpgrade python2-wheelUpgrade fence-agents-aliyunUpgrade Cython-debugsource | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade fence-agents-debuginfoUpgrade python2-pyyamlUpgrade Cython-debugsourceUpgrade python2-lxml-debuginfoUpgrade fence-agents-aliyunUpgrade python2-numpy-f2pyUpgrade python2-psycopg2-debugUpgrade python-coverage-debugsourceUpgrade python2-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python-psycopg2-docUpgrade fence-agents-debugsourceUpgrade python-psycopg2-debugsourceUpgrade python2-psycopg2-testsUpgrade python2-pymongo-gridfsUpgrade python2Upgrade python2-coverage-debuginfoUpgrade PyYAML-debugsourceUpgrade numpy-debugsourceUpgrade fence-agents-kubevirtUpgrade python-lxml-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-bsonUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2Upgrade fence-agents-openstackUpgrade fence-agents-aliyun-debuginfoUpgrade python2-testUpgrade scipy-debugsourceUpgrade fence-agents-kdumpUpgrade python2-coverageUpgrade python2-CythonUpgrade fence-agents-kdump-debuginfoUpgrade python2-pymongoUpgrade python2-bson-debuginfoUpgrade python2-debugUpgrade python2-pyyaml-debuginfoUpgrade python2-develUpgrade fence-agents-allUpgrade python2-tkinterUpgrade python-pymongo-debuginfoUpgrade python2-lxmlUpgrade python2-numpyUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-toolsUpgrade python2-sqlalchemyUpgrade python2-scipy-debuginfoUpgrade python2-scipyUpgrade python2-pymongo-debuginfoUpgrade python2-markupsafeUpgrade python2-libsUpgrade python2-debugsourceUpgrade python2-backportsUpgrade fence-agents-redfishUpgrade fence-agents-kubevirt-debuginfo | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python3-Jinja2Upgrade python-Jinja2-emacsUpgrade python311-Jinja2Upgrade python313-Jinja2Upgrade python-Jinja2-vim | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python-jinja2Upgrade python3-jinja2Upgrade python-jinja2 (Ubuntu Pro)Upgrade python3-jinja2 (Ubuntu Pro) | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub