StackRadar

CVE-2024-56201

High

Advisory

Published 23 Dec 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
251
of 17,781 indexed, latest versions
Container images
256
deployed by those charts
Fix available
3 of 3
affected packages

Jinja has a sandbox breakout through malicious filenames

Carried by container images the latest versions of 251 of 17,781 indexed charts deploy, on 256 images.

Affected packageAffected versionsFixed inImages
jinja2pypi3.0.0, 3.0.1, 3.0.2, 3.0.3+5 more3.1.5249
jinja2deb2.7.2-2, 2.10.1-2, 3.0.3-1, 3.0.3-1ubuntu0.1+1 more2.7.2-2ubuntu0.1~esm6, 2.10.1-2ubuntu0.4, 3.0.3-1ubuntu0.313
py3-jinja2apk3.1.2-r23.1.5-r01
OSV records
ALPINE-CVE-2024-56201GHSA-gmj6-6f8f-6699UBUNTU-CVE-2024-56201
Also known as
PYSEC-2026-1472, USN-7244-1, USN-7343-1

Charts affected

251 by stars
ChartLatestAffected imagesRadar Score
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2024-56201.

Container imageDigestPackageFixed in
flyway/flyway:9.14.1-alpine80f12c80502b
jinja2@3.1.2
3.1.5

Open the chart page →

5,846

Container images carrying it

256 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
muhammedgamal/fp23:latest74b4cd69b6fa
jinja2@3.1.4
3.1.5
1
nabinchhetri/flask-app:v2.0be189fbf3411
jinja2@3.1.2
3.1.5
1
nathanielvarona/pritunl-slack-app:0.1.10b746a34e5597
jinja2@3.1.3
3.1.5
1
netboxcommunity/netbox:v3.2.83d652dca5351
jinja2@3.1.2
3.1.5
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
jinja2@3.1.4
3.1.5
1
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
jinja2@3.0.3
3.1.5
1
opea/asr:1.025dd26d9cd09
jinja2@3.1.3
3.1.5
1
opea/guardrails-tgi:1.0262c6048aab8
jinja2@3.1.3
3.1.5
1
opea/guardrails-tgi:latestf68bec6a1271
jinja2@3.1.3
3.1.5
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
jinja2@3.1.3
3.1.5
1
opea/speecht5:1.0249afad3d268
jinja2@3.1.3
3.1.5
1
opea/tts:1.0257ae94709e9
jinja2@3.1.3
3.1.5
1
opea/web-retriever-chroma:1.0fe08165d7770
jinja2@3.1.4
3.1.5
1
openbas/caldera-server:5.1.0a277796d9724
jinja2@3.1.3
3.1.5
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
jinja2@3.1.3
3.1.5
1
openzaak/open-notificaties:1.3.02e65313b9b10
jinja2@3.1.0
3.1.5
1
openzaak/open-zaak:1.6.02ca2ea6e0ae9
jinja2@3.0.3
3.1.5
1
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
jinja2@3.0.3
3.1.5
1
pangeo/base-notebook:2024.01.155fbe688a4f80
jinja2@3.1.3
3.1.5
1
percona/pmm-server:3.9.1003f9c25f842
jinja2@3.1.2
3.1.5
1
phntom/email-manager:0.1.22d8e2a9f2f085
jinja2@3.1.2
3.1.5
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
jinja2@3.1.2
3.1.5
1
pococze/python-hello-elos:2.0.07a1aab425e51
jinja2@3.1.4
3.1.5
1
polyaxon/polyaxon-api:2.16.42b55c3265a90
jinja2@3.1.4
3.1.5
1
polyaxon/polyaxon-streams:2.16.4c186bd9834c0
jinja2@3.1.4
3.1.5
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
jinja2@3.1.4
3.1.5
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
jinja2@3.1.2
3.1.5
1
pysga1996/python-redis-web:latestfdeec30ad482
jinja2@3.1.2
3.1.5
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
jinja2@3.1.2
3.1.5
1
redislabs/redisearch:2.4.1433561794c5c8
jinja2@3.1.2
3.1.5
1
redislabs/redisinsight:1.14.0b03ab1426d0d
jinja2@3.1.2
3.1.5
1
reportportal/service-auto-analyzer:5.7.295ada4a216ce
jinja2@3.1.2
3.1.5
1
reportportal/service-metrics-gatherer:1.1.202a0e6dc11161
jinja2@3.1.2
3.1.5
1
roadiehq/community-backstage-image:latestef355bf5b639
jinja2@3.0.1
3.1.5
1
robmarkcole/deepstack-ui:latest410275726459
jinja2@3.0.1
3.1.5
1
robotshop/rs-payment:latest774b52c6180d
jinja2@3.0.1
3.1.5
1
saltstack/salt:3006.3e9c7906b7a5c
jinja2@3.1.2
3.1.5
1
seafileltd/seafile-mc:9.0.106693911bcc40
jinja2@3.1.2
3.1.5
1
seafileltd/seafile-mc:10.0.170628f29c663
jinja2@3.1.2
3.1.5
1
seafileltd/seafile-mc:9.0.97ac833196f60
jinja2@3.1.2
3.1.5
1
seafileltd/seafile-mc:11.0.12d0c66e4621bd
jinja2@3.1.4
3.1.5
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
jinja2@3.0.1
3.1.5
1
searx/searx:1.0.0-211-968b28993dbb3a6d9419
jinja2@3.0.1
3.1.5
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
jinja2@3.0.2
3.1.5
1
semaphoreui/semaphore:v2.9.645b50bc11833f
jinja2@3.1.2
py3-jinja2@3.1.2-r2
3.1.5
3.1.5-r0
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
jinja2@3.1.4
3.1.5
1
sirrend/helmup-notifications-service:0.1.3997866417011
jinja2@3.1.4
3.1.5
1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
jinja2@3.1.2
3.1.5
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
jinja2@3.1.4
3.1.5
1
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
jinja2@3.0.1
3.1.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.