StackRadar

CVE-2019-10906

High

Advisory

Published 6 Apr 2019In the index since 8 Sept 2026
Severity
High
worst across findings
CVSS
8.6
base score, highest
EPSS
0.036
89th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,781 indexed, latest versions
Container images
31
deployed by those charts
Fix available
2 of 2
affected packages

Jinja2 sandbox escape via string formatting

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 31 images.

Affected packageAffected versionsFixed inImages
jinja2pypi2.7.2, 2.8, 2.8.1, 2.9.4+2 more2.10.131
jinja2deb2.7.2-22.7.2-2ubuntu0.1~esm12
OSV records
GHSA-462w-v97r-4m45UBUNTU-CVE-2019-10906
Also known as
PYSEC-2019-217, USN-4011-2

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
jinja2@2.10
2.10.1

Open the chart page →

36,094
octoprinthalkeye0.1.11 of 1See more

octoprint halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
octoprint/octoprint:1.4.0106c26efcd8a
jinja2@2.8.1
2.10.1

Open the chart page →

3,608
radosgwananace-chartsVerified publisher0.3.41 of 1See more

radosgw ananace-charts 0.3.4

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
ceph/daemon:latest-nautilus90f30824a96e
jinja2@2.7.2
2.10.1

Open the chart page →

1,650
aks-helloworldazure-sample0.1.11 of 1See more

aks-helloworld azure-sample 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
neilpeterson/aks-helloworld:v1fb47732ef36b
jinja2@2.10
2.10.1

Open the chart page →

4,269
azure-voteazure-sample0.1.11 of 2See more

azure-vote azure-sample 0.1.1

1 of the 2 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
neilpeterson/azure-vote-front:v384062718347c
jinja2@2.10
2.10.1

Open the chart page →

5,224
azure-vote-osbaazure-sample0.1.01 of 1See more

azure-vote-osba azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
neilpeterson/azure-vote-front:v384062718347c
jinja2@2.10
2.10.1

Open the chart page →

4,269
twitter-sentimentazure-sample0.1.01 of 3See more

twitter-sentiment azure-sample 0.1.0

1 of the 3 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
neilpeterson/chart-tweet:latest64fd8dab075f
jinja2@2.10
2.10.1

Open the chart page →

11,833
tsoragecetic0.4.111 of 8See more

tsorage cetic 0.4.11

1 of the 8 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:5.0.1c87b1c07fb53
jinja2@2.9.6
2.10.1

Open the chart page →

12,018
daskcloudnativeapp2.2.12 of 2See more

dask cloudnativeapp 2.2.1

2 of the 2 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
daskdev/dask:1.1.04ecd7bc35500
jinja2@2.10
2.10.1
daskdev/dask-notebook:1.1.0052630f5ca04
jinja2@2.10
2.10.1

Open the chart page →

29,901
distributed-tensorflowcloudnativeapp0.1.11 of 1See more

distributed-tensorflow cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
cheyang/distributed-tf:1.6.046cc34755493
jinja2@2.10
2.10.1

Open the chart page →

36,094
locustcloudnativeapp1.0.01 of 1See more

locust cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
greenbirdit/locust:0.9.0e99d53bdc944
jinja2@2.10
2.10.1

Open the chart page →

1,352
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
jinja2@2.10
2.10.1

Open the chart page →

5,060
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
jinja2@2.7.2-2
jinja2@2.9.6
2.7.2-2ubuntu0.1~esm1
2.10.1
galaxy/galaxy-stable:v18.018e577a626dfd
jinja2@2.7.2-2
jinja2@2.7.2
2.7.2-2ubuntu0.1~esm1
2.10.1

Open the chart page →

70,895
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.6.14db6ff0b4045
jinja2@2.10
2.10.1

Open the chart page →

16,860
prometheus-aws-costs-exporterdeliveryheroVerified publisher0.1.51 of 1See more

prometheus-aws-costs-exporter deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
jinja2@2.10
2.10.1

Open the chart page →

3,553
my-chartfleet-web-app0.1.01 of 6See more

my-chart fleet-web-app 0.1.0

1 of the 6 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
richardchesterwood/k8s-fleetman-webapp-angular:release2ed7d720878ac
jinja2@2.10
2.10.1

Open the chart page →

24,296
prometheus-aws-costs-exporterhelm-charts-nr0.1.51 of 1See more

prometheus-aws-costs-exporter helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
jinja2@2.10
2.10.1

Open the chart page →

3,553
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
jinja2@2.10
2.10.1

Open the chart page →

7,232
kovi-appkovi-charts0.8.11 of 1See more

kovi-app kovi-charts 0.8.1

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
kennethreitz/httpbin:latest599fe5e50731
jinja2@2.10
2.10.1

Open the chart page →

14,813
webapp-colormarcusrepo0.1.11 of 1See more

webapp-color marcusrepo 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
kodekloud/webapp-color:latest99c3821ea49b
jinja2@2.10
2.10.1

Open the chart page →

911
comacopencord1.0.02 of 9See more

comac opencord 1.0.0

2 of the 9 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
jinja2@2.10
2.10.1
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
jinja2@2.10
2.10.1

Open the chart page →

88,546
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
jinja2@2.10
2.10.1

Open the chart page →

26,211
ponsimv2opencord1.2.31 of 2See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
voltha/voltha-tester:1.7.0655c3048a602
jinja2@2.8
2.10.1

Open the chart page →

12,609
sebaopencord1.0.04 of 17See more

seba opencord 1.0.0

4 of the 17 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
voltha/voltha-cli:1.6.0c4e41e92f046
jinja2@2.8
2.10.1
voltha/voltha-netconf:1.6.037f80524c207
jinja2@2.8
2.10.1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
jinja2@2.8
2.10.1
voltha/voltha-voltha:1.6.0ff596b62de59
jinja2@2.8
2.10.1

Open the chart page →

93,855
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
jinja2@2.9.6
2.10.1

Open the chart page →

36,215
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
jinja2@2.10
2.10.1

Open the chart page →

20,462
httpbinrgnu1.0.01 of 1See more

httpbin rgnu 1.0.0

1 of the 1 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
citizenstig/httpbin:latestb81c818ccb86
jinja2@2.9.4
2.10.1

Open the chart page →

11,422
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
jinja2@2.10
2.10.1

Open the chart page →

20,462
sentry-dbsentry0.9.41 of 10See more

sentry-db sentry 0.9.4

1 of the 10 container images this version deploys carry CVE-2019-10906.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:5.4.01bbda887bc53
jinja2@2.9.6
2.10.1

Open the chart page →

10,967

Container images carrying it

31 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
jinja2@2.10
2.10.1
2
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
jinja2@2.10
2.10.1
2
neilpeterson/azure-vote-front:v384062718347c
jinja2@2.10
2.10.1
2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
jinja2@2.10
2.10.1
2
amancevice/superset:0.28.1c8c04bfe3d66
jinja2@2.10
2.10.1
1
apachepulsar/pulsar:2.6.14db6ff0b4045
jinja2@2.10
2.10.1
1
ceph/daemon:latest-nautilus90f30824a96e
jinja2@2.7.2
2.10.1
1
cheyang/distributed-tf:1.6.046cc34755493
jinja2@2.10
2.10.1
1
citizenstig/httpbin:latestb81c818ccb86
jinja2@2.9.4
2.10.1
1
confluentinc/cp-kafka:5.4.01bbda887bc53
jinja2@2.9.6
2.10.1
1
confluentinc/cp-kafka:5.0.1c87b1c07fb53
jinja2@2.9.6
2.10.1
1
daskdev/dask:1.1.04ecd7bc35500
jinja2@2.10
2.10.1
1
daskdev/dask-notebook:1.1.0052630f5ca04
jinja2@2.10
2.10.1
1
galaxy/galaxy-init:v18.010267bad550e6
jinja2@2.7.2-2
jinja2@2.9.6
2.7.2-2ubuntu0.1~esm1
2.10.1
1
galaxy/galaxy-stable:v18.018e577a626dfd
jinja2@2.7.2-2
jinja2@2.7.2
2.7.2-2ubuntu0.1~esm1
2.10.1
1
greenbirdit/locust:0.9.0e99d53bdc944
jinja2@2.10
2.10.1
1
kennethreitz/httpbin:latest599fe5e50731
jinja2@2.10
2.10.1
1
kodekloud/webapp-color:latest99c3821ea49b
jinja2@2.10
2.10.1
1
neilpeterson/aks-helloworld:v1fb47732ef36b
jinja2@2.10
2.10.1
1
neilpeterson/chart-tweet:latest64fd8dab075f
jinja2@2.10
2.10.1
1
octoprint/octoprint:1.4.0106c26efcd8a
jinja2@2.8.1
2.10.1
1
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
jinja2@2.10
2.10.1
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
jinja2@2.9.6
2.10.1
1
richardchesterwood/k8s-fleetman-webapp-angular:release2ed7d720878ac
jinja2@2.10
2.10.1
1
roadiehq/community-backstage-image:latestef355bf5b639
jinja2@2.10
2.10.1
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
jinja2@2.10
2.10.1
1
voltha/voltha-cli:1.6.0c4e41e92f046
jinja2@2.8
2.10.1
1
voltha/voltha-netconf:1.6.037f80524c207
jinja2@2.8
2.10.1
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
jinja2@2.8
2.10.1
1
voltha/voltha-tester:1.7.0655c3048a602
jinja2@2.8
2.10.1
1
voltha/voltha-voltha:1.6.0ff596b62de59
jinja2@2.8
2.10.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.