Sandbox Escape Affecting jinja2 package, versions [,2.10.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JINJA2-174126
- published 7 Apr 2019
- disclosed 7 Apr 2019
- credit Brian Welch, Armin Ronacher
Introduced: 7 Apr 2019
CVE-2019-10906 Open this link in a new tabHow to fix?
Upgrade Jinja2 to version 2.10.1 or higher.
Overview
Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.
Affected versions of this package are vulnerable to Sandbox Escape via the str.format_map. This vulnerability requires the attacker to have information about sensitive attributes, and exploiting it could allow the attacker to access sensitive content.
Workaround
Override the is_safe_attribute method on the sandbox and explicitly disallow the format_map method on string objects.