Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Aikido] Fix security issue in jinja2 via minor version upgrade from 3.1.4 to 3.1.5 #287

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

aikido-autofix[bot]
Copy link

@aikido-autofix aikido-autofix bot commented Jan 8, 2025

This PR will resolve the following CVEs:

CVE ID Severity Description
CVE-2024-56201
HIGH
Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control bo...
CVE-2024-56326
HIGH
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the conten...
AIKIDO-2024-10560
MEDIUM
Affected versions of this package are affected by Code Injection due to a bypass in Jinja's sandbox validation that restricts direct calls to str.format possible by storing a reference to the format method of a malicious string and invoking it indirectly through a filter. This flaw allows an attac...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants