[Snyk:Medium] jinja2 (Due 04/09/2024 )

[pkfec]

Overview

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the xmlattr filter, when using keys containing spaces in an application accepts keys as user input. An attacker can inject arbitrary HTML attributes into the rendered HTML template, bypassing the auto-escaping mechanism, which may lead to the execution of untrusted scripts in the context of the user's browser session.

Note Accepting keys as user input is not common or a particularly intended use case of the xmlattr filter, and an application doing so should already be verifying what keys are provided regardless of this fix.

https://app.snyk.io/vuln/SNYK-PYTHON-JINJA2-6150717

Introduced through:

project@0.0.0 › jinja2@3.0.0
project@0.0.0 › django-jinja@2.10.2 › jinja2@3.0.0

Remediation:

Upgrade jinja2 to version 3.1.3

Completion criteria:

• Upgrade jinja2 to version 3.1.3

[cnlucas]