Executive brief
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Affected products
- PyPI jinja2
Junglewise Threat Intelligence
CVE-2019-10906: PYSEC-2019-217 - In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
CVE-2019-10906 · Severity: low · CVSS 3 · Published 2019-04-07
Technologies: jinja2 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1471 - Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
- PYSEC-2026-1475 - Jinja has a sandbox breakout through indirect reference to format method
- PYSEC-2026-1472 - Jinja has a sandbox breakout through malicious filenames
- PYSEC-2026-1474 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
- PYSEC-2026-1473 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter