CVE-2024-22195 Jinja vulnerable to Cross-Site Scripting (XSS)

2024-01-1102:25:44

CWE-79

GitHub_M

www.cve.org

jinja

cross-site scripting

xss

template engine

html injection

attribute validation

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

CNA Affected

[
  {
    "vendor": "pallets",
    "product": "jinja",
    "versions": [
      {
        "version": "< 3.1.3",
        "status": "affected"
      }
    ]
  }
]