<spam>

## Vulnerability Report Hi there! We found 3 known vulnerabilities in this project's dependencies during a routine open-source security scan. | CVE | Package | Current | Fixed | Severity | CVSS | EPSS | |-----|---------|---------|-------|----------|------|------| | [CVE-2025-27516](https://nvd.nist.gov/vuln/detail/CVE-2025-27516) | `jinja2` | 3.1.2 | 3.1.6 | HIGH | 8.8 | 0.21% | | [CVE-2024-56201](https://nvd.nist.gov/vuln/detail/CVE-2024-56201) | `jinja2` | 3.1.2 | 3.1.5 | HIGH | 8.8 | 0.46% | | [CVE-2024-56326](https://nvd.nist.gov/vuln/detail/CVE-2024-56326) | `jinja2` | 3.1.2 | 3.1.5 | HIGH | 7.8 | 0.34% | <details> <summary>Detailed analysis</summary> ### CVE-2025-27516 — `jinja2@3.1.2` **Jinja2 vulnerable to sandbox breakout through attr filter selecting format method** > Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the co... - **Priority:** HIGH - **Recommended action:** SCHEDULE PATCH - **Reasoning:** CVSS 8.8 indicates high severity with sandbox escape potential allowing arbitrary code execution. However, EPSS 0.00214 shows very low exploitation probability in the wild, and exploitation requires attacker control of template content. Not KEV-listed. The Medium scanner severity appears to underestimate the impact given the 8.8 CVSS score and code execution capability. ### CVE-2024-56201 — `jinja2@3.1.2` **Jinja has a sandbox breakout through malicious filenames** > Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, a... - **Priority:** HIGH - **Recommended action:** SCHEDULE PATCH - **Reasoning:** CVSS 8.8 indicates high severity with significant impact potential (C:H/I:H/A:H), but exploitation requires specific conditions: attacker control over both template content AND filename. Low EPSS (0.00459) suggests minimal wild exploitation. Not KEV-listed. Scanner severity of LOW appears inaccurate given the CVSS score and potential for arbitrary code execution when conditions are met. ### CVE-2024-56326 — `jinja2@3.1.2` **Jinja has a sandbox breakout through indirect reference to format method** > Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the conten... - **Priority:** HIGH - **Recommended action:** SCHEDULE PATCH - **Reasoning:** CVSS 7.8 indicates high impact (C:H/I:H/A:H) but local attack vector and low privileges required reduce immediate risk. Scanner marked as LOW severity appears inaccurate given 7.8 CVSS score. Low EPSS (0.00336) suggests minimal active exploitation. Sandbox escape vulnerabilities in template engines are serious but require attacker-controlled templates and custom filters to exploit. </details> ## Recommended Fix Update the following dependencies: ```bash pip install jinja2>=3.1.5 ``` --- *This issue was generated by CVERiskPilot — an AI-powered vulnerability triage and compliance platform. Our scanner analyzed this project's dependency tree and cross-referenced findings against NVD, EPSS (exploit probability), and CISA KEV (known exploited vulnerabilities) data.* *If this issue is not relevant or was filed in error, please close it and we apologize for the noise. We aim to only report actionable, high-severity findings with available fixes.*