CVE-2025-27516High· 7.3▾ TwilightA flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
high → medium
medium → high
high → medium
medium → high
high → medium
medium → high
high → medium
medium → high
high → medium
medium → high
high → medium
0.5% → 0.5%
Last analysed / modified upstream
medium → high
A flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox.
jinja2: Jinja sandbox breakout through attr filter selecting format method — rated Important by Red Hat. Released 2025-03-05, updated 2026-10-16.
Affected:
Fixed:
No fix planned:
Not affected:
Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:3123 Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:3124 Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:3160
Workarounds / mitigations:
Affected packages:
jinja2 < 3.1.6Patched in:
jinja2 3.1.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-65106High· 8.2langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates (CVE-2025-65106)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-104851High· 8.8fsspec is a specification and Python implementation framework for filesystem interfaces