Skip to content
Fencer Vulns
high 8.8

CVE-2025-27516 json

Jinja sandbox breakout through attr filter selecting format method

published 2025-03-05 20 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-6152 , GHSA-cpwx-vrp4-4pq7 , PYSEC-2026-1471

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.

Patch / fix

  • pypi jinja2 3.1.6
  • palletsprojects jinja 3.1.6
  • pocoo jinja2 3.1.6
  • jinja2 Debian 12 3.1.2-1+deb12u3
  • jinja2 Debian 14, Debian 13 3.1.6-1

debian advisories DEBIAN-CVE-2025-27516

  • jinja2 Ubuntu 20.04 LTS 2.10.1-2ubuntu0.5
  • jinja2 Ubuntu 22.04 LTS 3.0.3-1ubuntu0.4
  • jinja2 Ubuntu 24.04 LTS 3.1.2-1ubuntu1.3
  • jinja2 Ubuntu Pro 14.04 LTS 2.7.2-2ubuntu0.1~esm6
  • jinja2 Ubuntu Pro 16.04 LTS 2.8-1ubuntu0.1+esm5
  • jinja2 Ubuntu Pro 18.04 LTS 2.10-1ubuntu0.18.04.1+esm4

ubuntu advisories UBUNTU-CVE-2025-27516

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-jinja2 hummingbird 1 3.1.6-10.1.hum1
  • python3-jinja2 hummingbird 1 3.1.6-10.1.hum1
  • python3-jinja2+i18n hummingbird 1 3.1.6-10.1.hum1
  • python-jinja2 RHEL 10.0 3.1.6-1.el10_0
  • python3-jinja2 RHEL 10.0 3.1.6-1.el10_0
  • python3-jinja2+i18n RHEL 10.0 3.1.6-1.el10_0
  • python-jinja2 RHEL 9 2.11.3-8.el9_5
  • python3-jinja2 RHEL 9 2.11.3-8.el9_5

red hat advisories RHSA-2026:43940RHSA-2025:7476RHSA-2025:3671RHSA-2025:3622RHSA-2025:3588RHSA-2025:3585

  • python-Jinja2 SLE Module for Basesystem 15 SP6, SLE Micro 5.5, SLE Micro 5.4 +15 more 2.10.1-150000.3.21.1
  • python-Jinja2 Linux Micro 6.1 3.1.4-slfo.1.1_2.1
  • python-Jinja2 Linux Micro 6.0 3.1.2-8.1
  • python-Jinja2 SLE Module for Python 3 15 SP6, SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.6 3.1.2-150400.12.14.1

suse advisories SUSE-SU-2025:1004-2SUSE-SU-2025:20254-1SUSE-SU-2025:1004-1SUSE-SU-2025:20156-1SUSE-SU-2025:0956-1

  • python3-jinja2 AlmaLinux 10 3.1.6-1.el10_0
  • python3-jinja2+i18n AlmaLinux 10 3.1.6-1.el10_0
  • python3-jinja2 AlmaLinux 8 2.10.1-7.el8_10
  • python3-jinja2 AlmaLinux 9 2.11.3-8.el9_5

almalinux advisories ALSA-2025:7476ALSA-2025:3388ALSA-2025:3406

  • python-jinja2 Rocky Linux 10 3.1.6-1.el10_0
  • fence-agents Rocky Linux 9 4.10.0-76.el9_5.6
  • python-jinja2 Rocky Linux 9 2.11.3-8.el9_5
  • python-jinja2 Rocky Linux 8 2.10.1-7.el8_10

rocky linux advisories RLSA-2025:7476RLSA-2025:3113RLSA-2025:3406RLSA-2025:3388

  • py3-jinja2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 3.1.6-r0

alpine advisories ALPINE-CVE-2025-27516

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-jinja2 CBL-Mariner 2.0 3.0.3-7
  • python-jinja2 Azure Linux 3.0 3.1.2-3
  • nodejs18 CBL-Mariner 2.0 18.20.3-5
  • nodejs Azure Linux 3.0 20.14.0-7
  • nodejs24 Azure Linux 3.0 24.13.0-1

azure linux advisories AZL-57800AZL-57878AZL-58063AZL-58067AZL-75804

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-27516 updated cvss 7.3

jinja2: Jinja sandbox breakout through attr filter selecting format method

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-istio-controller-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 python-jinja2
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AI (RHEL AI) ui-rhel9, bootc-amd-rhel9, bootc-intel-rhel9, bootc-nvidia-rhel9, docling-serve-rhel9, bootc-azure-amd-rhel9, +7 more Red Hat OpenShift AI (RHOAI) odh-model-registry-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/ose-ovn-kubernetes, ose-ovn-kubernetes-base-container, openshift4/ztp-site-generate-rhel8
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 python-jinja2 Red Hat OpenStack Platform 18.0 python-jinja2 Red Hat Satellite 6 python-jinja2, python2-jinja2 Red Hat Update Infrastructure 4 for Cloud Providers python-jinja2
    under investigation
  • Red Hat Ansible Automation Platform Execution Environments ansible-automation-platform/ee-minimal-rhel8 2.17.9-3, ansible-automation-platform/ee-minimal-rhel8 2.18.3-3, ansible-automation-platform/ee-minimal-rhel9 2.17.9-4, ansible-automation-platform/ee-minimal-rhel9 2.18.3-4, ansible-automation-platform/ee-minimal-rhel8 2.16.14-11, ansible-automation-platform/ee-minimal-rhel9 2.16.14-12
    fixed: vendor fix RHSA-2025:2664
  • Red Hat Quay v3 quay/quay-rhel8 v3.12.9-8, quay/clair-rhel8 v3.12.9-3, quay/clair-rhel8 v3.13.5-4, quay/clair-rhel8 v3.14.1-1, quay/clair-rhel8 v3.9.11-5, quay/quay-rhel8 v3.11.10-9, +54 more
    fixed: vendor fix RHBA-2025:7674
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-jinja2 3.1.6-1.el8ap, python3x-jinja2 3.1.6-1.el8ap, automation-controller-venv-tower 4.5.20-1.el8ap, ansible-automation-platform-24/lightspeed-rhel8 2.4.250225-5 Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-jinja2 3.1.6-1.el9ap, python3-jinja2 3.1.6-1.el9ap, automation-controller-venv-tower 4.5.20-1.el9ap
    fixed: vendor fix RHSA-2025:3123
show 26 more
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.11-jinja2 3.1.6-1.el8ap, automation-controller-venv-tower 4.6.10-1.el8ap, ansible-automation-platform-25/lightspeed-rhel8 2.5.250318-2 Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.11-jinja2 3.1.6-1.el9ap, automation-controller-venv-tower 4.6.10-1.el9ap
    fixed: vendor fix RHSA-2025:3160
  • Red Hat Developer Hub (RHDH) 1.4 rhdh 1.4.3-1743652461
    fixed: vendor fix RHSA-2025:3595
  • Red Hat Developer Hub 1.5 rhdh
    fixed: vendor fix RHSA-2025:3374
  • Red Hat Enterprise Linux AppStream (v. 8) python-jinja2 2.10.1-7.el8_10, python3-jinja2 2.10.1-7.el8_10
    fixed: vendor fix RHSA-2025:3388
  • Red Hat Enterprise Linux AppStream (v. 9) fence-virt 4.10.0-76.el9_5.6, python-jinja2 2.11.3-8.el9_5, fence-virtd 4.10.0-76.el9_5.6, python3-jinja2 2.11.3-8.el9_5, fence-agents 4.10.0-76.el9_5.6, fence-virtd-cpg 4.10.0-76.el9_5.6, +10 more
    fixed: vendor fix RHSA-2025:3113
  • Red Hat Enterprise Linux AppStream (v. 10) python-jinja2 3.1.6-1.el10_0, python3-jinja2 3.1.6-1.el10_0
    fixed: vendor fix RHSA-2025:7476
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) python-jinja2 2.10.1-2.el8_2.4, python3-jinja2 2.10.1-2.el8_2.4
    fixed: vendor fix RHSA-2025:3671
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) python-jinja2 2.10.1-2.el8_4.2, python3-jinja2 2.10.1-2.el8_4.2
    fixed: vendor fix RHSA-2025:3562
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) python-jinja2 2.10.1-4.el8_6.2, python3-jinja2 2.10.1-4.el8_6.2
    fixed: vendor fix RHSA-2025:3622
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) python-jinja2 2.10.1-2.el8_4.2, python3-jinja2 2.10.1-2.el8_4.2
    fixed: vendor fix RHSA-2025:3562
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) python-jinja2 2.10.1-4.el8_6.2, python3-jinja2 2.10.1-4.el8_6.2
    fixed: vendor fix RHSA-2025:3622
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) python-jinja2 2.11.3-5.el9_0, fence-virt 4.10.0-20.el9_0.21, python3-jinja2 2.11.3-5.el9_0, fence-virtd 4.10.0-20.el9_0.21, fence-agents 4.10.0-20.el9_0.21, fence-virtd-cpg 4.10.0-20.el9_0.21, +11 more
    fixed: vendor fix RHSA-2025:3017
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) python-jinja2 2.10.1-5.el8_8, python3-jinja2 2.10.1-5.el8_8
    fixed: vendor fix RHSA-2025:3580
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) python-jinja2 2.11.3-5.el9_2, fence-virt 4.10.0-43.el9_2.12, python3-jinja2 2.11.3-5.el9_2, fence-virtd 4.10.0-43.el9_2.12, fence-agents 4.10.0-43.el9_2.12, fence-virtd-cpg 4.10.0-43.el9_2.12, +10 more
    fixed: vendor fix RHSA-2025:3111
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-jinja2 2.11.3-7.el9_4, fence-virt 4.10.0-62.el9_4.11, python3-jinja2 2.11.3-7.el9_4, fence-virtd 4.10.0-62.el9_4.11, fence-agents 4.10.0-62.el9_4.11, fence-virtd-cpg 4.10.0-62.el9_4.11, +10 more
    fixed: vendor fix RHSA-2025:2688
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) python-jinja2 2.10.1-2.el8_4.2, python3-jinja2 2.10.1-2.el8_4.2
    fixed: vendor fix RHSA-2025:3562
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) python-jinja2 2.10.1-4.el8_6.2, python3-jinja2 2.10.1-4.el8_6.2
    fixed: vendor fix RHSA-2025:3622
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-jinja2+i18n 3.1.6-1.el10_0
    fixed: vendor fix RHSA-2025:7476
  • Red Hat Enterprise Linux High Availability (v. 9) fence-agents-all 4.10.0-76.el9_5.6, fence-agents-apc 4.10.0-76.el9_5.6, fence-agents-aws 4.10.0-76.el9_5.6, fence-agents-eps 4.10.0-76.el9_5.6, fence-agents-gce 4.10.0-76.el9_5.6, fence-agents-rsa 4.10.0-76.el9_5.6, +36 more
    fixed: vendor fix RHSA-2025:3113
  • Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-all 4.10.0-20.el9_0.21, fence-agents-apc 4.10.0-20.el9_0.21, fence-agents-aws 4.10.0-20.el9_0.21, fence-agents-eps 4.10.0-20.el9_0.21, fence-agents-gce 4.10.0-20.el9_0.21, fence-agents-rsa 4.10.0-20.el9_0.21, +36 more
    fixed: vendor fix RHSA-2025:3017
  • Red Hat Enterprise Linux High Availability EUS (v.9.2) fence-agents-all 4.10.0-43.el9_2.12, fence-agents-apc 4.10.0-43.el9_2.12, fence-agents-aws 4.10.0-43.el9_2.12, fence-agents-eps 4.10.0-43.el9_2.12, fence-agents-gce 4.10.0-43.el9_2.12, fence-agents-rsa 4.10.0-43.el9_2.12, +36 more
    fixed: vendor fix RHSA-2025:3111
  • Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-all 4.10.0-62.el9_4.11, fence-agents-apc 4.10.0-62.el9_4.11, fence-agents-aws 4.10.0-62.el9_4.11, fence-agents-eps 4.10.0-62.el9_4.11, fence-agents-gce 4.10.0-62.el9_4.11, fence-agents-rsa 4.10.0-62.el9_4.11, +36 more
    fixed: vendor fix RHSA-2025:2688
  • Red Hat Enterprise Linux Resilient Storage (v. 9) fence-agents-all 4.10.0-76.el9_5.6, fence-agents-apc 4.10.0-76.el9_5.6, fence-agents-aws 4.10.0-76.el9_5.6, fence-agents-eps 4.10.0-76.el9_5.6, fence-agents-gce 4.10.0-76.el9_5.6, fence-agents-rsa 4.10.0-76.el9_5.6, +36 more
    fixed: vendor fix RHSA-2025:3113
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) fence-agents-all 4.10.0-43.el9_2.12, fence-agents-apc 4.10.0-43.el9_2.12, fence-agents-aws 4.10.0-43.el9_2.12, fence-agents-eps 4.10.0-43.el9_2.12, fence-agents-gce 4.10.0-43.el9_2.12, fence-agents-rsa 4.10.0-43.el9_2.12, +36 more
    fixed: vendor fix RHSA-2025:3111
  • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-all 4.10.0-62.el9_4.11, fence-agents-apc 4.10.0-62.el9_4.11, fence-agents-aws 4.10.0-62.el9_4.11, fence-agents-eps 4.10.0-62.el9_4.11, fence-agents-gce 4.10.0-62.el9_4.11, fence-agents-rsa 4.10.0-62.el9_4.11, +36 more
    fixed: vendor fix RHSA-2025:2688
  • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) fence-agents-all 4.10.0-20.el9_0.21, fence-agents-apc 4.10.0-20.el9_0.21, fence-agents-aws 4.10.0-20.el9_0.21, fence-agents-eps 4.10.0-20.el9_0.21, fence-agents-gce 4.10.0-20.el9_0.21, fence-agents-rsa 4.10.0-20.el9_0.21, +36 more
    fixed: vendor fix RHSA-2025:3017

9 more fixed, 21 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.4 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 5.4 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi jinja2
<3.1.6
3.1.6

Affected products

  • pallets jinja

Classification

Weakness
  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.