CVE-2024-56326

Summary

CVE-2024-56326 is a vulnerability affecting Jinja, an extensible templating engine, prior to version 3.1.5. This issue arises due to an oversight in Jinja's sandboxed environment, which fails to adequately detect calls to Python's str.format function in templates. An attacker who can control a template's content can exploit this vulnerability to execute arbitrary Python code. Custom filters present in an application could potentially facilitate such attacks. With the release of version 3.1.5, Jinja now handles indirect calls to the str.format method within its sandbox, eliminating this vulnerability. Applications using untrusted templates are at risk, and developers are urged to upgrade to the latest version of Jinja to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.