REDHAT-BUG-2333854
First published: Mon Dec 23 2024(Updated: )
Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jinja | <3.1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2333854#c5
- https://access.redhat.com/errata/RHSA-2025:0335
- https://access.redhat.com/errata/RHSA-2025:0338
- https://access.redhat.com/errata/RHSA-2025:0341
- https://access.redhat.com/errata/RHSA-2025:0345
- https://access.redhat.com/errata/RHSA-2025:0721
- https://access.redhat.com/errata/RHSA-2025:0722
- https://access.redhat.com/errata/RHSA-2025:0753
- https://access.redhat.com/errata/RHSA-2025:0656
- https://access.redhat.com/errata/RHSA-2025:0777
- https://access.redhat.com/errata/RHSA-2025:0875
- https://access.redhat.com/errata/RHSA-2025:1101
- https://access.redhat.com/errata/RHSA-2025:0834
- https://access.redhat.com/errata/RHSA-2025:0842
- https://access.redhat.com/errata/RHSA-2025:0830
- https://access.redhat.com/errata/RHSA-2025:1123
- https://access.redhat.com/errata/RHSA-2025:1130
- https://access.redhat.com/errata/RHSA-2025:1118
- https://access.redhat.com/errata/RHSA-2025:1861
- https://access.redhat.com/errata/RHSA-2025:3491
- https://bugzilla.redhat.com/show_bug.cgi?id=2333854
Frequently Asked Questions
What is the severity of REDHAT-BUG-2333854?
The severity of REDHAT-BUG-2333854 is high due to the potential for arbitrary code execution.
How do I fix REDHAT-BUG-2333854?
To fix REDHAT-BUG-2333854, upgrade Jinja to version 3.1.5 or later.
Who is affected by REDHAT-BUG-2333854?
Users of Jinja versions prior to 3.1.5 are affected by REDHAT-BUG-2333854.
What type of vulnerability is REDHAT-BUG-2333854?
REDHAT-BUG-2333854 is a code execution vulnerability in the Jinja templating engine.
What can an attacker do with REDHAT-BUG-2333854?
An attacker exploiting REDHAT-BUG-2333854 can execute arbitrary Python code by controlling the template content and filename.
- agent/severity
- agent/first-publish-date
- agent/description
- agent/type
- agent/event
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/references
- agent/last-modified-date
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-56201
- vendor/jinja
- canonical/jinja