CVE-2025-3841 wix-incubator jam Jinja2 Template jam.py special elements used in a template engine
Attackers can execute arbitrary code via malicious template arguments in the wix-incubator jam Jinja2 handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-3841?
CVE-2025-3841 is a medium-severity code injection vulnerability in wix-incubator jam, published on 21 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the argument config['template'] leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
Which versions are affected by CVE-2025-3841?
It affects 1 product.
Products include Wix Jam.
How do I fix CVE-2025-3841?
No fix has been published for CVE-2025-3841 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-3841 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-3841 exists.
Sources
Also known as GHSA-q438-4f7x-vcx4.