Executive brief
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
Affected products
- PyPI jinja2
Junglewise Threat Intelligence
CVE-2024-22195: PYSEC-2026-1473 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
CVE-2024-22195 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: jinja2 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1471 - Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
- PYSEC-2026-1475 - Jinja has a sandbox breakout through indirect reference to format method
- PYSEC-2026-1472 - Jinja has a sandbox breakout through malicious filenames
- PYSEC-2026-1474 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
- Nautobot secrets exposure and data manipulation via Jinja2 templating