| Package | Affected versions | Patched versions |
|---|---|---|
| jinja2 | < 2.10.1 | 2.10.1 |
| jinja | < 2.10.1 | 2.10.1 |
| software collections | = 1.0 |
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.format_map method could be used to escape the sandbox.
This issue was previously addressed for the str.format method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common str.format_map method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the is_safe_attribute method on the sandbox and explicitly disallow the format_map method on string objects.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free