CVE-2024-56201
HighAdvisory
Published 23 Dec 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.8
- base score, highest
- EPSS
- 0.003
- 23rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 251
- of 17,781 indexed, latest versions
- Container images
- 256
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Jinja has a sandbox breakout through malicious filenames
Carried by container images the latest versions of 251 of 17,781 indexed charts deploy, on 256 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jinja2pypi | 3.0.0, 3.0.1, 3.0.2, 3.0.3+5 more | 3.1.5 | 249 |
| jinja2deb | 2.7.2-2, 2.10.1-2, 3.0.3-1, 3.0.3-1ubuntu0.1+1 more | 2.7.2-2ubuntu0.1~esm6, 2.10.1-2ubuntu0.4, 3.0.3-1ubuntu0.3 | 13 |
| py3-jinja2apk | 3.1.2-r2 | 3.1.5-r0 | 1 |
- OSV records
- ALPINE-CVE-2024-56201GHSA-gmj6-6f8f-6699UBUNTU-CVE-2024-56201
- Also known as
- PYSEC-2026-1472, USN-7244-1, USN-7343-1
Charts affected
251 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
Container images carrying it
256 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 2528c6e57587 | jinja2 | 3.1.5 | 1 |
| quay.io/ | 60725dab588c | jinja2 | 3.1.5 | 1 |
| quay.io/ | cae8c0622533 | jinja2 | 3.1.5 | 1 |
| quay.io/ | 59fe607dfdf2 | jinja2 | 3.1.5 | 1 |
| quay.io/ | e0d9b93dbf2b | jinja2 | 3.1.5 | 1 |
| registry.gitlab.com/ | 4e7faf6f8d5f | jinja2 | 3.1.5 | 1 |