CVE-2016-10745 Jinja2 sandbox escape vulnerability

High 8.6 Published 8 Apr 2019 Updated 6 Aug 2024

Attackers can execute arbitrary code by exploiting a sandbox escape in the str.format method of the Jinja templating library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-10745?

CVE-2016-10745 is a high-severity code injection vulnerability in n/a, published on 8 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

Weakness: CWE-134

Which versions are affected by CVE-2016-10745?

3 open source packages ship an affected version, including jinja2 and Jinja2. It affects 1 product.

Package	Affected	Fixed in
`jinja2` PyPI	All versions	`2.8.1`
`jinja2` PyPI	All versions	`2.8.1`
`Jinja2` PyPI	All versions	`2.8.1`

Linux distribution packages (12)

`python-jinja2` Red Hat:enterprise_linux:7::client	All versions	`0:2.7.2-3.el7_6`
`python-jinja2` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.7.2-3.el7_6`
`python-jinja2` Red Hat:enterprise_linux:7::server	All versions	`0:2.7.2-3.el7_6`
`python-jinja2` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.7.2-3.el7_6`
`python-jinja2` Red Hat:rhel_aus:7.4::server	All versions	`0:2.7.2-3.el7_4`
`python-jinja2` Red Hat:rhel_e4s:7.4::server	All versions	`0:2.7.2-3.el7_4`
`python-jinja2` Red Hat:rhel_eus:7.5::computenode	All versions	`0:2.7.2-3.el7_5`
`python-jinja2` Red Hat:rhel_eus:7.5::server	All versions	`0:2.7.2-3.el7_5`
`python-jinja2` Red Hat:rhel_tus:7.4::server	All versions	`0:2.7.2-3.el7_4`
`python-Jinja2` SUSE:Linux Enterprise Module for Advanced Systems Management 12	All versions	`2.8-19.17.1`
`python-Jinja2` SUSE:Linux Enterprise Module for Public Cloud 12	All versions	`2.8-19.17.1`
`python-Jinja2` SUSE:Manager Client Tools 12	All versions	`2.8-19.17.1`

Products include Palletsprojects Jinja.

How do I fix CVE-2016-10745?

Upgrade jinja2 to 2.8.1 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2016-10745 being exploited?

There is no known exploitation of CVE-2016-10745 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2016-10745, GHSA-hj2j-77xm-mc5v, PYSEC-2019-220, RHSA-2019:1022, RHSA-2019:3964, RHSA-2019:4062 and 2 more.