--- id: CVE-2025-27516 aliases: - GHSA-cpwx-vrp4-4pq7 - PYSEC-2026-1471 title: >- Jinja2 vulnerable to sandbox breakout through attr filter selecting format method summary: >- Jinja2 vulnerable to sandbox breakout through attr filter selecting format method severity: medium cvss: 7.3 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H' vendor: jinja2 product: jinja2 ecosystem: pip affected: - jinja2 < 3.1.6 patched: - jinja2 3.1.6 published: '2025-03-05' updated: '2026-09-10' sourceUpdated: '2026-09-10T03:49:48.526758681Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7' references: - url: 'https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-27516' - url: >- https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403 - url: 'https://github.com/pallets/jinja' - url: 'https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html' - url: 'https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27516.json - url: 'https://access.redhat.com/security/cve/CVE-2025-27516' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2350190' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-27516' - url: 'https://access.redhat.com/errata/RHSA-2025:3123' - url: 'https://access.redhat.com/errata/RHSA-2025:3124' - url: 'https://access.redhat.com/errata/RHSA-2025:3160' - url: 'https://access.redhat.com/errata/RHSA-2025:3162' - url: 'https://access.redhat.com/errata/RHBA-2025:7674' - url: 'https://access.redhat.com/errata/RHBA-2025:3653' - url: 'https://access.redhat.com/errata/RHBA-2025:3652' - url: 'https://access.redhat.com/errata/RHBA-2025:3651' - url: 'https://access.redhat.com/errata/RHSA-2025:4408' - url: 'https://access.redhat.com/errata/RHSA-2025:3779' - url: 'https://access.redhat.com/errata/RHSA-2025:3568' - url: 'https://access.redhat.com/errata/RHSA-2025:3789' - url: 'https://access.redhat.com/errata/RHSA-2025:2664' - url: 'https://access.redhat.com/errata/RHSA-2025:3371' - url: 'https://access.redhat.com/errata/RHSA-2025:4730' - url: 'https://access.redhat.com/errata/RHSA-2025:4203' - url: 'https://access.redhat.com/errata/RHSA-2025:4431' - url: 'https://access.redhat.com/errata/RHSA-2025:4018' - url: 'https://access.redhat.com/errata/RHSA-2025:3775' - url: 'https://access.redhat.com/errata/RHSA-2025:7476' - url: 'https://access.redhat.com/errata/RHSA-2025:3388' - url: 'https://access.redhat.com/errata/RHSA-2025:3671' - url: 'https://access.redhat.com/errata/RHSA-2025:3562' tags: - osv - pip - csaf - vex - red-hat epss: 0.00497 epssPercentile: 0.40033 cvssSource: vendor cwe: - CWE-1336 ingestedAt: '2026-07-08T18:25:48.511Z' --- ## Overview An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to use the `|attr` filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the `|attr` filter no longer bypasses the environment's attribute lookup. ## Affected packages - `jinja2 < 3.1.6` ## Remediation Upgrade to a patched release: - `jinja2 3.1.6` ## Vendor advisories - **RHSA-2025:3123** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 · released 2025-03-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:3123) - **RHSA-2025:3124** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 for RHEL 8 · released 2025-03-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:3124) - **RHSA-2025:3160** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2025-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2025:3160) - **RHSA-2025:3162** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8 · released 2025-03-25 · [advisory](https://access.redhat.com/errata/RHSA-2025:3162) - **RHBA-2025:7674** · Red Hat · fixed in: Quay v3 · released 2025-05-15 · [advisory](https://access.redhat.com/errata/RHBA-2025:7674) - **RHBA-2025:3653** · Red Hat · fixed in: Quay v3 · released 2025-04-14 · [advisory](https://access.redhat.com/errata/RHBA-2025:3653) - **RHBA-2025:3652** · Red Hat · fixed in: Quay v3 · released 2025-04-21 · [advisory](https://access.redhat.com/errata/RHBA-2025:3652) - **RHBA-2025:3651** · Red Hat · fixed in: Quay v3 · released 2025-05-09 · [advisory](https://access.redhat.com/errata/RHBA-2025:3651) - **RHSA-2025:4408** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2025-05-08 · [advisory](https://access.redhat.com/errata/RHSA-2025:4408) - **RHSA-2025:3779** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2025-04-17 · [advisory](https://access.redhat.com/errata/RHSA-2025:3779) - **RHSA-2025:3568** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2025-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:3568) - **Red Hat VEX** · Important · affected: OpenShift Serverless, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 18.0, … · no fix planned: Red Hat Enterprise Linux 6, OpenShift Serverless, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux AI (RHEL AI), … · updated 2026-09-06 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27516.json)