What’s Vulnerable › Vulnerabilities

CVE-2016-10745

• Severity: high (CVSS 8.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-08 · updated 2026-06-17
• Weakness: CWE-134

Description

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

Affected products

• pallets jinja: before 2.8.1 — fixed in 2.8.1

How to fix

Upgrade to a fixed version: pallets jinja 2.8.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html
• https://access.redhat.com/errata/RHSA-2019:1022
• https://access.redhat.com/errata/RHSA-2019:1237
• https://access.redhat.com/errata/RHSA-2019:1260
• https://access.redhat.com/errata/RHSA-2019:3964
• https://access.redhat.com/errata/RHSA-2019:4062
• https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
• https://palletsprojects.com/blog/jinja-281-released/
• https://usn.ubuntu.com/4011-1/
• https://usn.ubuntu.com/4011-2/
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html

Get alerted when CVE-2016-10745 or the next vulnerability affects your stack