Executive brief
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Affected products
- PyPI jinja2
Junglewise Threat Intelligence
CVE-2016-10745: PYSEC-2019-220 - In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
CVE-2016-10745 · Severity: low · CVSS 3 · Published 2019-04-08
Technologies: jinja2 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1471 - Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
- PYSEC-2026-1475 - Jinja has a sandbox breakout through indirect reference to format method
- PYSEC-2026-1472 - Jinja has a sandbox breakout through malicious filenames
- PYSEC-2026-1474 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
- PYSEC-2026-1473 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter