You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: /workflows,/mgmtworker,/rest-service,/cloudify_types,/amqp-postgres/test-requirements.txt,/amqp-postgres,/cloudify_types/dev-requirements.txt,/rest-service/dev-requirements.txt
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
CVE-2024-22195 - Medium Severity Vulnerability
A very fast and expressive template engine.
Library home page: https://files.pythonhosted.org/packages/65/e0/eb35e762802015cab1ccee04e8a277b03f1d8e53da3ec3106882ec42558b/Jinja2-2.10.3-py2.py3-none-any.whl
Path to dependency file: /workflows
Path to vulnerable library: /workflows,/mgmtworker,/rest-service,/cloudify_types,/amqp-postgres/test-requirements.txt,/amqp-postgres,/cloudify_types/dev-requirements.txt,/rest-service/dev-requirements.txt
Dependency Hierarchy:
Found in HEAD commit: 203fcf9f96b1849f0840fc2235bfef38a3ff706c
Found in base branch: master
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja
xmlattr
filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.Publish Date: 2024-01-11
URL: CVE-2024-22195
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-h5c8-rqwp-cp95
Release Date: 2024-01-11
Fix Resolution: 3.1.3
The text was updated successfully, but these errors were encountered: