CVE-2024-56201
HighAdvisory
Published 23 Dec 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.8
- base score, highest
- EPSS
- 0.003
- 23rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 251
- of 17,781 indexed, latest versions
- Container images
- 256
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Jinja has a sandbox breakout through malicious filenames
Carried by container images the latest versions of 251 of 17,781 indexed charts deploy, on 256 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jinja2pypi | 3.0.0, 3.0.1, 3.0.2, 3.0.3+5 more | 3.1.5 | 249 |
| jinja2deb | 2.7.2-2, 2.10.1-2, 3.0.3-1, 3.0.3-1ubuntu0.1+1 more | 2.7.2-2ubuntu0.1~esm6, 2.10.1-2ubuntu0.4, 3.0.3-1ubuntu0.3 | 13 |
| py3-jinja2apk | 3.1.2-r2 | 3.1.5-r0 | 1 |
- OSV records
- ALPINE-CVE-2024-56201GHSA-gmj6-6f8f-6699UBUNTU-CVE-2024-56201
- Also known as
- PYSEC-2026-1472, USN-7244-1, USN-7343-1
Charts affected
251 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
Container images carrying it
256 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| atlassian/ | 05933f2b1cfd | jinja2 | 3.1.5 | 1 |
| atlassian/ | 3b9222ab32ef | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| atlassian/ | c81cc7d6bc9e | jinja2 | 3.1.5 | 1 |
| atlassian/ | ebf761c7d437 | jinja2 | 3.1.5 | 1 |
| atlassian/ | 37bc46cbec1a | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| atlassian/ | 64a75aa4ec4e | jinja2 | 3.1.5 | 1 |
| atlassian/ | e5548cd4eea8 | jinja2 | 3.1.5 | 1 |
| avinash263/ | aa2b8727f1a6 | jinja2 | 3.1.5 | 1 |
| azhar008/ | a1e827b0adea | jinja2 | 3.1.5 | 1 |
| behnambm/ | bd3ad88afff9 | jinja2 | 3.1.5 | 1 |
| buntha/ | 154542cc3083 | jinja2 | 3.1.5 | 1 |
| clowder/ | 11f3d844e4c0 | jinja2 | 3.1.5 | 1 |
| clowder/ | 14155326c7b9 | jinja2 | 3.1.5 | 1 |
| clowder/ | bf146f1ca24f | jinja2 | 3.1.5 | 1 |
| clsen2024/ | 1156cd87c8fb | jinja2 | 3.1.5 | 1 |
| clsen2024/ | 0ba9eff852c5 | jinja2 | 3.1.5 | 1 |
| clsen2024/ | 51b1d45961cd | jinja2 | 3.1.5 | 1 |
| clsen2024/ | efb1586c8299 | jinja2 | 3.1.5 | 1 |
| codecov/ | 837f546b479b | jinja2 | 3.1.5 | 1 |
| confluentinc/ | adc392d28a1e | jinja2 | 3.1.5 | 1 |
| confluentinc/ | 8ec46c27982f | jinja2 | 3.1.5 | 1 |
| confluentinc/ | 5ca5f3269814 | jinja2 | 3.1.5 | 1 |
| danuk/ | 026560388070 | jinja2 | 3.1.5 | 1 |
| datawire/ | 95ec30b3c732 | jinja2 | 3.1.5 | 1 |
| datawire/ | 1f67a1292d2a | jinja2 | 3.1.5 | 1 |
| ddosify/ | 71b8768f49bc | jinja2 | 3.1.5 | 1 |
| devopsgoofy/ | ad865312099f | jinja2 | 3.1.5 | 1 |
| devopstales/ | 42c40a0e9f1b | jinja2 | 3.1.5 | 1 |
| dinutac/ | 9340dde8a8a4 | jinja2 | 3.1.5 | 1 |
| douz/ | 4384103d0219 | jinja2 | 3.1.5 | 1 |
| dpage/ | 18cd5711fc9a | jinja2 | 3.1.5 | 1 |
| dpage/ | 37946e4f3e7b | jinja2 | 3.1.5 | 1 |
| dpage/ | 561c1f8f99f2 | jinja2 | 3.1.5 | 1 |
| errbotio/ | 00ee4e0953ab | jinja2 | 3.1.5 | 1 |
| evk02/ | ef6ff257ef35 | jinja2 | 3.1.5 | 1 |
| factly/ | ca5bc71d1d5c | jinja2 | 3.1.5 | 1 |
| fiware/ | c3c1c8ccfb45 | jinja2 | 3.1.5 | 1 |
| flyway/ | 45b5d7cdc75a | jinja2 | 3.1.5 | 1 |
| flyway/ | 80f12c80502b | jinja2 | 3.1.5 | 1 |
| fossology/ | 8bd1f22ba7bb | jinja2 | 3.1.5 | 1 |
| frankescobar/ | 8a4d7e9308de | jinja2 | 3.1.5 | 1 |
| frankescobar/ | cafa03b94dac | jinja2 | 3.1.5 | 1 |
| freeipa/ | c87d77342bf5 | jinja2 | 3.1.5 | 1 |
| galaxy/ | e5c265fe9fcd | jinja2 | 3.1.5 | 1 |
| galaxy/ | 0267bad550e6 | jinja2 | 2.7.2-2ubuntu0.1~esm6 | 1 |
| galaxy/ | 8e577a626dfd | jinja2 | 2.7.2-2ubuntu0.1~esm6 | 1 |
| gmaas2/ | 148fc2d9afe9 | jinja2 | 3.1.5 | 1 |
| goofball222/ | 7bf26032dfce | jinja2 | 3.1.5 | 1 |
| hamzaarshad10/ | 2c1c3b86a8e7 | jinja2 | 3.1.5 | 1 |
| hayk96/ | 86377705e9e3 | jinja2 | 3.1.5 | 1 |