CVE-2024-22195mediumCWE-79

CVE-2024-22195: fallo de gravedad media en pallets jinja

Jinja vulnerable to Cross-Site Scripting (XSS)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear jinja+ Monitorear jinja2

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.9%
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Productos afectados
pallets · jinja
CVEs relacionadas — pallets jinja

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-34064MEDIUMJinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filterEPSS 1.0%CVE-2024-56326MEDIUMJinja has a sandbox breakout through indirect reference to format methodEPSS 0.5%CVE-2025-27516MEDIUMJinja sandbox breakout through attr filter selecting format methodEPSS 0.5%CVE-2024-56201MEDIUMJinja has a sandbox breakout through malicious filenamesEPSS 0.3%