RHLW-2026-bbcf7d39b1fbb255: Lightwell Security Advisory: jinja2 3.1.5+rhlw.1

Q: What access does an attacker need to exploit this issue?

The vulnerability has local attack vector and low attack complexity. Exploitation requires low privileges and does not require user interaction.

Q: What is the potential impact if exploitation succeeds?

The listed impact includes high confidentiality, integrity, and availability effects, with scope changed. The issue is a Jinja sandbox breakout involving the attr filter selecting the format method.

Q: Which package should be deployed to address the issue?

Red Hat Lightwell released jinja2 3.1.5+rhlw.1 with a backported security fix for CVE-2025-27516. It is described as a drop-in replacement for jinja2 3.1.5 from PyPI.

Published Nov 10, 2026

Updated

Red Hat Lightwell has released jinja2 3.1.5+rhlw.1 with a backported security fix.

CVE-2025-27516: Jinja sandbox breakout through attr filter selecting format method

This patched artifact is a drop-in replacement for jinja2 3.1.5 from PyPI.

Affected Software

1 affected componentFixes available

red-hat-lightwell/jinja2<3.1.5+rhlw.1

3.1.5+rhlw.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/jinja2 to a version that resolves this vulnerability.
Fixed in 3.1.5+rhlw.1
Upgrade
Upgrade jinja2 to a version that resolves this vulnerability.
Fixed in 3.1.5+rhlw.1

Event History

Nov 10, 2026

Advisory Published

via OSV·02:35 PM

Data Sourced

via OSV·02:35 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability has local attack vector and low attack complexity. Exploitation requires low privileges and does not require user interaction.

What is the potential impact if exploitation succeeds?

The listed impact includes high confidentiality, integrity, and availability effects, with scope changed. The issue is a Jinja sandbox breakout involving the attr filter selecting the format method.

Which package should be deployed to address the issue?

Red Hat Lightwell released jinja2 3.1.5+rhlw.1 with a backported security fix for CVE-2025-27516. It is described as a drop-in replacement for jinja2 3.1.5 from PyPI.

RHLW-2026-bbcf7d39b1fbb255: Lightwell Security Advisory: jinja2 3.1.5+rhlw.1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which package should be deployed to address the issue?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which package should be deployed to address the issue?