FlawAtlas
Search the atlas
CVE-2019-10906 High

CVE-2019-10906

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

Exploit probability 3.6%
Published April 7, 2019
Required by Not available
Last source change July 8, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

17 explicit affected versions

PyPI jinja2

31 explicit affected versions

PyPI jinja2

31 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2019-10906

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

View original source
Open Source Vulnerabilities GHSA-462w-v97r-4m45

In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox. This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods. If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

View original source
Open Source Vulnerabilities PYSEC-2019-217

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

View original source

05 / REFERENCES

Further evidence