{"id":"CVE-2025-27516","aliases":["GHSA-cpwx-vrp4-4pq7","PYSEC-2026-1471"],"title":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","severity":"medium","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","vendor":"jinja2","product":"jinja2","ecosystem":"pip","affected":["jinja2 < 3.1.6"],"patched":["jinja2 3.1.6"],"published":"2025-03-05","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:48.526758681Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7","references":[{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"url":"https://github.com/pallets/jinja"},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27516.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-27516"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2350190"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27516"},{"url":"https://access.redhat.com/errata/RHSA-2025:3123"},{"url":"https://access.redhat.com/errata/RHSA-2025:3124"},{"url":"https://access.redhat.com/errata/RHSA-2025:3160"},{"url":"https://access.redhat.com/errata/RHSA-2025:3162"},{"url":"https://access.redhat.com/errata/RHBA-2025:7674"},{"url":"https://access.redhat.com/errata/RHBA-2025:3653"},{"url":"https://access.redhat.com/errata/RHBA-2025:3652"},{"url":"https://access.redhat.com/errata/RHBA-2025:3651"},{"url":"https://access.redhat.com/errata/RHSA-2025:4408"},{"url":"https://access.redhat.com/errata/RHSA-2025:3779"},{"url":"https://access.redhat.com/errata/RHSA-2025:3568"},{"url":"https://access.redhat.com/errata/RHSA-2025:3789"},{"url":"https://access.redhat.com/errata/RHSA-2025:2664"},{"url":"https://access.redhat.com/errata/RHSA-2025:3371"},{"url":"https://access.redhat.com/errata/RHSA-2025:4730"},{"url":"https://access.redhat.com/errata/RHSA-2025:4203"},{"url":"https://access.redhat.com/errata/RHSA-2025:4431"},{"url":"https://access.redhat.com/errata/RHSA-2025:4018"},{"url":"https://access.redhat.com/errata/RHSA-2025:3775"},{"url":"https://access.redhat.com/errata/RHSA-2025:7476"},{"url":"https://access.redhat.com/errata/RHSA-2025:3388"},{"url":"https://access.redhat.com/errata/RHSA-2025:3671"},{"url":"https://access.redhat.com/errata/RHSA-2025:3562"}],"tags":["osv","pip","csaf","vex","red-hat"],"epss":0.00497,"epssPercentile":0.39948,"cvssSource":"vendor","cwe":["CWE-1336"],"ingestedAt":"2026-07-08T18:25:48.511Z","slug":"CVE-2025-27516","body":"## Overview\n\nAn oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup.\n\n## Affected packages\n\n- `jinja2 < 3.1.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jinja2 3.1.6`\n\n## Vendor advisories\n\n- **RHSA-2025:3123** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2025-03-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:3123)\n- **RHSA-2025:3124** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8 · released 2025-03-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:3124)\n- **RHSA-2025:3160** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2025-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2025:3160)\n- **RHSA-2025:3162** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8 · released 2025-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2025:3162)\n- **RHBA-2025:7674** · Red Hat · fixed in: Quay v3 · released 2025-05-15 · [advisory](https://access.redhat.com/errata/RHBA-2025:7674)\n- **RHBA-2025:3653** · Red Hat · fixed in: Quay v3 · released 2025-04-14 · [advisory](https://access.redhat.com/errata/RHBA-2025:3653)\n- **RHBA-2025:3652** · Red Hat · fixed in: Quay v3 · released 2025-04-21 · [advisory](https://access.redhat.com/errata/RHBA-2025:3652)\n- **RHBA-2025:3651** · Red Hat · fixed in: Quay v3 · released 2025-05-09 · [advisory](https://access.redhat.com/errata/RHBA-2025:3651)\n- **RHSA-2025:4408** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2025-05-08 · [advisory](https://access.redhat.com/errata/RHSA-2025:4408)\n- **RHSA-2025:3779** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2025-04-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:3779)\n- **RHSA-2025:3568** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2025-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:3568)\n- **Red Hat VEX** · Important · affected: OpenShift Serverless, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 18.0, … · no fix planned: Red Hat Enterprise Linux 6, OpenShift Serverless, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux AI (RHEL AI), … · updated 2026-09-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27516.json)","depth":"sunlit","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201404,"id":"CVE-2025-27516","ts":1789399412999,"field":"severity","old":"high","new":"medium"},{"seq":200139,"id":"CVE-2025-27516","ts":1789396815257,"field":"severity","old":"medium","new":"high"},{"seq":196935,"id":"CVE-2025-27516","ts":1789384252191,"field":"severity","old":"high","new":"medium"},{"seq":195862,"id":"CVE-2025-27516","ts":1789383232406,"field":"severity","old":"medium","new":"high"},{"seq":194790,"id":"CVE-2025-27516","ts":1789380230738,"field":"severity","old":"high","new":"medium"},{"seq":193578,"id":"CVE-2025-27516","ts":1789378098829,"field":"severity","old":"medium","new":"high"},{"seq":192364,"id":"CVE-2025-27516","ts":1789376149721,"field":"severity","old":"high","new":"medium"},{"seq":191152,"id":"CVE-2025-27516","ts":1789372948460,"field":"severity","old":"medium","new":"high"},{"seq":189936,"id":"CVE-2025-27516","ts":1789369068553,"field":"severity","old":"high","new":"medium"},{"seq":188724,"id":"CVE-2025-27516","ts":1789367915616,"field":"severity","old":"medium","new":"high"},{"seq":187506,"id":"CVE-2025-27516","ts":1789364911834,"field":"severity","old":"high","new":"medium"},{"seq":186294,"id":"CVE-2025-27516","ts":1789362857504,"field":"severity","old":"medium","new":"high"},{"seq":185079,"id":"CVE-2025-27516","ts":1789360897892,"field":"severity","old":"high","new":"medium"},{"seq":183867,"id":"CVE-2025-27516","ts":1789357762245,"field":"severity","old":"medium","new":"high"},{"seq":182119,"id":"CVE-2025-27516","ts":1789354035560,"field":"severity","old":"high","new":"medium"},{"seq":180912,"id":"CVE-2025-27516","ts":1789352794949,"field":"severity","old":"medium","new":"high"},{"seq":179705,"id":"CVE-2025-27516","ts":1789349909123,"field":"severity","old":"high","new":"medium"},{"seq":178498,"id":"CVE-2025-27516","ts":1789347643970,"field":"severity","old":"medium","new":"high"},{"seq":177291,"id":"CVE-2025-27516","ts":1789346099179,"field":"severity","old":"high","new":"medium"},{"seq":176084,"id":"CVE-2025-27516","ts":1789342590099,"field":"severity","old":"medium","new":"high"},{"seq":175870,"id":"CVE-2025-27516","ts":1789342197145,"field":"severity","old":"high","new":"medium"},{"seq":175408,"id":"CVE-2025-27516","ts":1789338225030,"field":"severity","old":"medium","new":"high"},{"seq":174203,"id":"CVE-2025-27516","ts":1789334536944,"field":"severity","old":"high","new":"medium"},{"seq":170626,"id":"CVE-2025-27516","ts":1789328216773,"field":"severity","old":"medium","new":"high"},{"seq":169421,"id":"CVE-2025-27516","ts":1789326817933,"field":"severity","old":"high","new":"medium"},{"seq":168216,"id":"CVE-2025-27516","ts":1789323252221,"field":"severity","old":"medium","new":"high"},{"seq":167011,"id":"CVE-2025-27516","ts":1789319293284,"field":"severity","old":"high","new":"medium"},{"seq":165806,"id":"CVE-2025-27516","ts":1789318075982,"field":"severity","old":"medium","new":"high"},{"seq":164601,"id":"CVE-2025-27516","ts":1789315472778,"field":"severity","old":"high","new":"medium"},{"seq":163396,"id":"CVE-2025-27516","ts":1789313120924,"field":"severity","old":"medium","new":"high"},{"seq":162191,"id":"CVE-2025-27516","ts":1789311655318,"field":"severity","old":"high","new":"medium"},{"seq":160986,"id":"CVE-2025-27516","ts":1789308095657,"field":"severity","old":"medium","new":"high"},{"seq":160952,"id":"CVE-2025-27516","ts":1789307854869,"field":"severity","old":"high","new":"medium"},{"seq":160304,"id":"CVE-2025-27516","ts":1789303857684,"field":"severity","old":"medium","new":"high"},{"seq":159365,"id":"CVE-2025-27516","ts":1789300326664,"field":"severity","old":"high","new":"medium"},{"seq":158329,"id":"CVE-2025-27516","ts":1789299129242,"field":"severity","old":"medium","new":"high"},{"seq":157293,"id":"CVE-2025-27516","ts":1789296398354,"field":"severity","old":"high","new":"medium"},{"seq":156088,"id":"CVE-2025-27516","ts":1789294239345,"field":"severity","old":"medium","new":"high"},{"seq":154883,"id":"CVE-2025-27516","ts":1789292551580,"field":"severity","old":"high","new":"medium"},{"seq":153678,"id":"CVE-2025-27516","ts":1789289165574,"field":"severity","old":"medium","new":"high"},{"seq":152890,"id":"CVE-2025-27516","ts":1789285057650,"field":"severity","old":"high","new":"medium"},{"seq":152134,"id":"CVE-2025-27516","ts":1789280781475,"field":"severity","old":"medium","new":"high"},{"seq":151095,"id":"CVE-2025-27516","ts":1789277349857,"field":"severity","old":"high","new":"medium"},{"seq":150062,"id":"CVE-2025-27516","ts":1789275765469,"field":"severity","old":"medium","new":"high"},{"seq":149029,"id":"CVE-2025-27516","ts":1789273545871,"field":"severity","old":"high","new":"medium"},{"seq":147824,"id":"CVE-2025-27516","ts":1789270730091,"field":"severity","old":"medium","new":"high"},{"seq":145864,"id":"CVE-2025-27516","ts":1789269127144,"field":"severity","old":"high","new":"medium"},{"seq":144768,"id":"CVE-2025-27516","ts":1789266012209,"field":"severity","old":"medium","new":"high"},{"seq":143672,"id":"CVE-2025-27516","ts":1789262357379,"field":"severity","old":"high","new":"medium"},{"seq":142508,"id":"CVE-2025-27516","ts":1789261070979,"field":"severity","old":"medium","new":"high"}]}