Executive brief
Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
Affected products
- PyPI jinja2
Junglewise Threat Intelligence
CVE-2025-27516: PYSEC-2026-1471 - Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
CVE-2025-27516 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: jinja2 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1475 - Jinja has a sandbox breakout through indirect reference to format method
- PYSEC-2026-1472 - Jinja has a sandbox breakout through malicious filenames
- PYSEC-2026-1474 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
- PYSEC-2026-1473 - Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
- Nautobot secrets exposure and data manipulation via Jinja2 templating