CVE-2025-27516

 

Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
https://nvd.nist.gov/vuln/detail/CVE-2025-27516

Categories

CWE-1336 : Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. This term is used for injection into template engines being used by a server. This term is used for injection into template engines being used by a client. Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands. Use the template engine's sandbox or restricted mode, if available. Chain: Python bindings for LLMlibrary do not use a sandboxed environment whenparsing a template and constructing a prompt,allowing jinja2 Server Side Template Injection andcode execution - one variant of a "promptinjection" attack. server-side template injection in content management server authentication / identity management product has client-side template injection Server-Side Template Injection using a Twig template devops platform allows SSTI bypass of Server-Side Template Injection protection mechanism with macros in Velocity templates web browser proxy server allows Java EL expressions from Server-Side Template Injection SSTI involving mail templates and JEXL expressions product does not use a "safe" setting for a FreeMarker configuration, allowing SSTI product allows read of sensitive database username/password variables using server-side template injection

References


 

CPE

cpe start end

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry