Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-awsUpgrade python2-psycopg2Upgrade fence-agents-heuristics-pingUpgrade fence-agents-sbdUpgrade python2-ipaddressUpgrade python2-docsUpgrade python2-wheelUpgrade fence-agents-emersonUpgrade python2-rpm-macrosUpgrade fence-agents-virshUpgrade babelUpgrade python2-setuptoolsUpgrade python2-dnsUpgrade python2-pytest-mockUpgrade python-sqlalchemy-docUpgrade python2-pyyamlUpgrade python2-funcsigsUpgrade python2-mockUpgrade fence-agents-vmware-soapUpgrade fence-agents-computeUpgrade fence-agents-ibmbladeUpgrade python2-bsonUpgrade fence-virtdUpgrade fence-agents-brocadeUpgrade fence-agents-cisco-ucsUpgrade python2-CythonUpgrade python2-setuptools_scmUpgrade python2-numpy-docUpgrade fence-agents-ipmilanUpgrade fence-agents-cisco-mdsUpgrade fence-agents-bladecenterUpgrade fence-agents-ilo2Upgrade python2-pytestUpgrade python2-docutilsUpgrade fence-agents-allUpgrade python2-debugUpgrade python2-scipyUpgrade python2-libsUpgrade fence-agents-amt-wsUpgrade python2-toolsUpgrade python2-psycopg2-testsUpgrade fence-virtd-libvirtUpgrade python2-noseUpgrade fence-agents-kdumpUpgrade fence-agents-kubevirtUpgrade fence-agents-redfishUpgrade fence-agents-ibm-vpcUpgrade python2-sqlalchemyUpgrade python2-virtualenvUpgrade fence-agents-ibm-powervsUpgrade python2-attrsUpgrade fence-agents-gceUpgrade fence-agents-azure-armUpgrade python2-coverageUpgrade fence-virtd-tcpUpgrade fence-virtd-cpgUpgrade python2-psycopg2-debugUpgrade python2-PyMySQLUpgrade fence-agents-rsaUpgrade python2-develUpgrade fence-agents-lparUpgrade python2-jinja2Upgrade python2-pysocksUpgrade python2-pip-wheelUpgrade python2-pluggyUpgrade fence-agents-mpathUpgrade fence-agents-apcUpgrade python2-tkinterUpgrade python2-numpyUpgrade fence-agents-vmware-restUpgrade python2-testUpgrade python2-idnaUpgrade python2-chardetUpgrade fence-agents-epsUpgrade python2-pytzUpgrade fence-agents-zvmUpgrade fence-agents-rsbUpgrade fence-agents-apc-snmpUpgrade python2-lxmlUpgrade python2-pygmentsUpgrade python2-setuptools-wheelUpgrade fence-virtd-serialUpgrade fence-virtd-multicastUpgrade fence-agents-openstackUpgrade fence-agents-aliyunUpgrade ha-cloud-supportUpgrade python2-docs-infoUpgrade python2-pymongoUpgrade python2-wheel-wheelUpgrade python2-sixUpgrade python2Upgrade python3-jinja2Upgrade fence-agents-drac5Upgrade python2-babelUpgrade fence-agents-hpbladeUpgrade python2-backportsUpgrade fence-agents-ilo-mpUpgrade python-psycopg2-docUpgrade python2-requestsUpgrade fence-agents-commonUpgrade python2-pymongo-gridfsUpgrade fence-agents-rhevmUpgrade fence-agents-wtiUpgrade python2-pipUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-eaton-snmpUpgrade python2-pyUpgrade fence-virtUpgrade python2-backports-ssl_match_hostnameUpgrade python-nose-docsUpgrade fence-agents-intelmodularUpgrade fence-agents-ilo-sshUpgrade python2-urllib3Upgrade fence-agents-ipduUpgrade python2-markupsafeUpgrade fence-agents-scsiUpgrade python2-numpy-f2pyUpgrade fence-agents-ifmib | May 8, 2024 | Jan 11, 2024 |
| Alpine Linux | — | Upgrade py3-jinja2 | Jun 6, 2024 | Jan 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python3-jinja2Upgrade python-jinja2 | Feb 8, 2024 | Jan 11, 2024 |
| Debian | — | Upgrade jinja2 | Jan 29, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-jinja2 | Mar 13, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-jinja2 | May 31, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-jinja2Upgrade python2-jinja2 | Jul 24, 2024 | Jan 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-jinja2 | Jul 17, 2024 | Jan 11, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade python2-noseUpgrade python2-babelUpgrade fence-agents-computeUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ipduUpgrade fence-agents-rhevmUpgrade fence-agents-rsbUpgrade python2-pip-wheelUpgrade fence-agents-sbdUpgrade fence-agents-scsiUpgrade fence-virtdUpgrade fence-virtd-cpgUpgrade python2-sqlalchemyUpgrade fence-agents-allUpgrade fence-agents-intelmodularUpgrade python2-docsUpgrade python2-develUpgrade fence-agents-cisco-mdsUpgrade fence-agents-ibmbladeUpgrade python2-bsonUpgrade python2-psycopg2Upgrade fence-agents-kdumpUpgrade fence-agents-ilo-mpUpgrade python2-coverageUpgrade fence-agents-rsaUpgrade python2-libsUpgrade fence-agents-bladecenterUpgrade fence-agents-drac5Upgrade fence-agents-virshUpgrade python2-docs-infoUpgrade python2-numpyUpgrade python2-virtualenvUpgrade python2-PyMySQLUpgrade python2-scipyUpgrade fence-agents-ipmilanUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo2Upgrade fence-agents-redfishUpgrade fence-agents-emersonUpgrade fence-virtd-tcpUpgrade fence-agents-heuristics-pingUpgrade python2-CythonUpgrade python2-debugUpgrade python2-toolsUpgrade python2-ipaddressUpgrade babelUpgrade python2-funcsigsUpgrade python2-pytest-mockUpgrade fence-agents-amt-wsUpgrade fence-agents-mpathUpgrade python-nose-docsUpgrade python2-dnsUpgrade fence-virtUpgrade python2-docutilsUpgrade python2-pyUpgrade python2-setuptools-wheelUpgrade python2-pyyamlUpgrade python2-pytestUpgrade fence-agents-vmware-soapUpgrade python2-pipUpgrade fence-agents-ilo-sshUpgrade python2-tkinterUpgrade python2-jinja2Upgrade fence-agents-apcUpgrade python2-attrsUpgrade python2-rpm-macrosUpgrade python2-setuptools_scmUpgrade fence-agents-ifmibUpgrade fence-agents-eaton-snmpUpgrade python2-psycopg2-debugUpgrade python2-setuptoolsUpgrade python2-urllib3Upgrade fence-virtd-serialUpgrade python2-numpy-docUpgrade python2-pysocksUpgrade fence-virtd-libvirtUpgrade fence-agents-brocadeUpgrade python2-testUpgrade python2-numpy-f2pyUpgrade python2-pluggyUpgrade fence-agents-lparUpgrade fence-agents-ibm-vpcUpgrade fence-agents-commonUpgrade fence-agents-apc-snmpUpgrade python2Upgrade python2-pymongoUpgrade python2-backportsUpgrade fence-agents-hpbladeUpgrade python-psycopg2-docUpgrade python-sqlalchemy-docUpgrade python2-mockUpgrade python2-psycopg2-testsUpgrade python2-pytzUpgrade fence-virtd-multicastUpgrade python2-wheelUpgrade fence-agents-wtiUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-ucsUpgrade python3-jinja2Upgrade python2-pygmentsUpgrade python2-lxmlUpgrade fence-agents-vmware-restUpgrade fence-agents-epsUpgrade python2-wheel-wheelUpgrade python2-requestsUpgrade python2-sixUpgrade python2-pymongo-gridfsUpgrade python2-chardetUpgrade python2-backports-ssl_match_hostnameUpgrade python2-markupsafeUpgrade python2-idna | May 7, 2024 | Jan 11, 2024 |
| Redhat_linux | — | Upgrade python2Upgrade fence-agents-ilo2Upgrade fence-agents-apcUpgrade fence-virtd-serialUpgrade ha-openstack-supportUpgrade python2-numpy-docUpgrade python-psycopg2-debugsourceUpgrade python2-psycopg2-debuginfoUpgrade python2-coverage-debuginfoUpgrade fence-virtUpgrade fence-agents-openstackUpgrade fence-virtd-multicastUpgrade fence-virtd-libvirt-debuginfoUpgrade python2-tkinterUpgrade python-pymongo-debugsourceUpgrade python2-pytzUpgrade python2-virtualenvUpgrade python2-requestsUpgrade python2-mockUpgrade fence-agents-brocadeUpgrade python2-scipy-debuginfoUpgrade fence-agents-vmware-restUpgrade python2-pygmentsUpgrade fence-agents-drac5Upgrade fence-agents-wtiUpgrade fence-virtd-tcp-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade fence-agents-ilo-moonshotUpgrade python2-testUpgrade fence-agents-lparUpgrade numpy-debugsourceUpgrade python2-dnsUpgrade fence-agents-kdump-debuginfoUpgrade python2-pymongoUpgrade fence-agents-ibm-vpcUpgrade python2-pytestUpgrade python2-idnaUpgrade python2-psycopg2-testsUpgrade python3-jinja2Upgrade fence-agents-cisco-ucsUpgrade python2-pluggyUpgrade python-psycopg2-docUpgrade python2-setuptoolsUpgrade python2-urllib3Upgrade fence-agents-gceUpgrade python2-setuptools_scmUpgrade python2-sqlalchemyUpgrade python2-wheel-wheelUpgrade fence-agents-awsUpgrade python2-pymongo-gridfsUpgrade fence-agents-debugsourceUpgrade fence-agents-ilo-sshUpgrade python2-bsonUpgrade python-sqlalchemy-docUpgrade python2-pysocksUpgrade python2-jinja2Upgrade fence-agents-hpbladeUpgrade python2-backports-ssl_match_hostnameUpgrade python2-funcsigsUpgrade python2-psycopg2-debugUpgrade scipy-debugsourceUpgrade fence-agents-zvmNo solution existsUpgrade python2-lxmlUpgrade python2-backportsUpgrade fence-agents-ifmibUpgrade python2-rpm-macrosUpgrade fence-agents-ipmilanUpgrade fence-virtd-multicast-debuginfoUpgrade fence-agents-eaton-snmpUpgrade python2-markupsafeUpgrade python2-debuginfoUpgrade python2-attrsUpgrade fence-agents-vmware-soapUpgrade python2-pyyamlUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-redfishUpgrade python2-wheelUpgrade fence-agents-debuginfoUpgrade python2-numpy-debuginfoUpgrade fence-virtd-cpgUpgrade python2-lxml-debuginfoUpgrade fence-virtd-libvirtUpgrade babelUpgrade python-lxml-debugsourceUpgrade fence-agents-kubevirtUpgrade fence-agents-apc-snmpUpgrade python2-toolsUpgrade fence-agents-scsiUpgrade PyYAML-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade fence-agents-rhevmUpgrade fence-agents-amt-wsUpgrade python2-noseUpgrade fence-agents-ibm-powervsUpgrade Cython-debugsourceUpgrade python2-numpy-f2pyUpgrade ha-cloud-supportUpgrade python2-sixUpgrade fence-agents-commonUpgrade ha-openstack-support-debuginfoUpgrade fence-agents-kdumpUpgrade fence-agents-allUpgrade fence-agents-aliyun-debuginfoUpgrade python2-babelUpgrade python2-libsUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-virshUpgrade fence-virtd-debuginfoUpgrade python2-docutilsUpgrade python2-pipUpgrade fence-agents-epsUpgrade python-pymongo-debuginfoUpgrade python2-docsUpgrade python-nose-docsUpgrade python2-pyUpgrade fence-virtdUpgrade python2-pytest-mockUpgrade fence-agents-azure-armUpgrade fence-agents-rsbUpgrade python2-coverageUpgrade fence-agents-ipduUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-debugsourceUpgrade python2-scipyUpgrade python2-PyMySQLUpgrade fence-agents-aliyunUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-sbdUpgrade python2-numpyUpgrade python2-debugUpgrade fence-agents-emersonUpgrade fence-agents-computeUpgrade fence-agents-intelmodularUpgrade fence-agents-bladecenterUpgrade python-coverage-debugsourceUpgrade python2-pymongo-debuginfoUpgrade fence-virtd-tcpUpgrade fence-agents-mpathUpgrade python2-psycopg2Upgrade python2-setuptools-wheelUpgrade python2-develUpgrade fence-agents-ilo-mpUpgrade fence-agents-rsaUpgrade python2-Cython-debuginfoUpgrade fence-agents-ibmbladeUpgrade python2-docs-infoUpgrade python2-bson-debuginfoUpgrade python2-ipaddressUpgrade fence-agents-cisco-mdsUpgrade fence-agents-heuristics-pingUpgrade python2-pip-wheelUpgrade python2-chardetUpgrade python-psycopg2-debuginfoUpgrade python2-CythonUpgrade fence-virt-debuginfo | Mar 6, 2024 | Jan 11, 2024 |
| Rocky_linux | — | Upgrade python2-libsUpgrade python2-markupsafeUpgrade python2-numpyUpgrade python2-numpy-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-toolsUpgrade python2-bson-debuginfoUpgrade python2-debugsourceUpgrade python2-pymongoUpgrade fence-agents-kubevirt-debuginfoUpgrade python2-sqlalchemyUpgrade python2-pymongo-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-backportsUpgrade fence-agents-allUpgrade fence-agents-redfishUpgrade python2-lxmlUpgrade python2-scipyUpgrade python2-debugUpgrade python2-tkinterUpgrade python-pymongo-debuginfoUpgrade python2-coverageUpgrade python2-CythonUpgrade python2-develUpgrade python2-pyyaml-debuginfoUpgrade python2-testUpgrade python2-pyyamlUpgrade fence-agents-openstackUpgrade numpy-debugsourceUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-coverage-debuginfoUpgrade python-psycopg2-debugsourceUpgrade python-lxml-debugsourceUpgrade python2-lxml-debuginfoUpgrade Cython-debugsourceUpgrade fence-agents-aliyunUpgrade python2-debuginfoUpgrade python2-numpy-f2pyUpgrade python2-psycopg2-debuginfoUpgrade python2Upgrade python-psycopg2-debuginfoUpgrade fence-agents-debugsourceUpgrade scipy-debugsourceUpgrade fence-agents-kdumpUpgrade fence-agents-aliyun-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-psycopg2Upgrade python2-pymongo-gridfsUpgrade PyYAML-debugsourceUpgrade fence-agents-kubevirtUpgrade python-coverage-debugsourceUpgrade fence-agents-debuginfoUpgrade python2-psycopg2-debugUpgrade python-psycopg2-docUpgrade python2-bson | Jun 17, 2024 | Jan 11, 2024 |
| Suse | — | Upgrade python-Jinja2-emacsUpgrade python311-Jinja2Upgrade python-Jinja2-vimUpgrade python313-Jinja2Upgrade python3-Jinja2 | May 31, 2024 | Jan 11, 2024 |
| Ubuntu | — | Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python3-jinja2Upgrade python-jinja2Upgrade python-jinja2 (Ubuntu Pro) | Jan 26, 2024 | Jan 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub