CVE-2024-56201
HighAdvisory
Published 23 Dec 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.8
- base score, highest
- EPSS
- 0.003
- 23rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 251
- of 17,781 indexed, latest versions
- Container images
- 256
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Jinja has a sandbox breakout through malicious filenames
Carried by container images the latest versions of 251 of 17,781 indexed charts deploy, on 256 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jinja2pypi | 3.0.0, 3.0.1, 3.0.2, 3.0.3+5 more | 3.1.5 | 249 |
| jinja2deb | 2.7.2-2, 2.10.1-2, 3.0.3-1, 3.0.3-1ubuntu0.1+1 more | 2.7.2-2ubuntu0.1~esm6, 2.10.1-2ubuntu0.4, 3.0.3-1ubuntu0.3 | 13 |
| py3-jinja2apk | 3.1.2-r2 | 3.1.5-r0 | 1 |
- OSV records
- ALPINE-CVE-2024-56201GHSA-gmj6-6f8f-6699UBUNTU-CVE-2024-56201
- Also known as
- PYSEC-2026-1472, USN-7244-1, USN-7343-1
Charts affected
251 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
Container images carrying it
256 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| shashkist/ | 581de1fd6084 | jinja2 | 3.1.5 | 4 |
| cloudve/ | 4a3d7fae90bb | jinja2 | 3.1.5 | 3 |
| dpage/ | 781369df9994 | jinja2 | 3.1.5 | 3 |
| paulkellerman/ | 381eeccb0618 | jinja2 | 3.1.5 | 3 |
| paulkellerman/ | 5a37b74f61b9 | jinja2 | 3.1.5 | 3 |
| quay.io/ | 6545dac92173 | jinja2 | 3.1.5 | 3 |
| blakeblackshear/ | 8330b0a265b8 | jinja2 | 3.1.5 | 2 |
| cs3org/ | 02a9e78757b4 | jinja2 | 3.1.5 | 2 |
| devopsjourney1/ | bd1ec6838570 | jinja2 | 3.1.5 | 2 |
| kodekloud/ | 3a856afb02a3 | jinja2 | 3.1.5 | 2 |
| langgenius/ | 09b7e8705673 | jinja2 | 3.1.5 | 2 |
| lncm/ | 36eaa06f99f4 | jinja2 | 3.1.5 | 2 |
| locustio/ | a0d4b88e42c1 | jinja2 | 3.1.5 | 2 |
| ngoduykhanh/ | ba36ab196d3d | jinja2 | 3.1.5 | 2 |
| opea/ | 5c9639de61c1 | jinja2 | 3.1.5 | 2 |
| opea/ | e48613afb191 | jinja2 | 3.1.5 | 2 |
| opea/ | eb746b263705 | jinja2 | 3.1.5 | 2 |
| polyaxon/ | eca6952b20e6 | jinja2 | 3.1.5 | 2 |
| polyaxon/ | 024ff3fa775e | jinja2 | 3.1.5 | 2 |
| qichenxu4pd/ | f3a8502bc21b | jinja2 | 3.1.5 | 2 |
| streamnative/ | 0e6d7aa3ef32 | jinja2 | 3.1.5 | 2 |
| ghcr.io/ | f1064d49124c | jinja2 | 3.1.5 | 2 |
| ahmetgrbzz/ | 08e10f9c0f53 | jinja2 | 3.1.5 | 1 |
| ahmetgrbzz/ | 35c37ae2bafd | jinja2 | 3.1.5 | 1 |
| ahmetgrbzz/ | 2e7fef69c29f | jinja2 | 3.1.5 | 1 |
| ahmetgrbzz/ | f018bafd2b0c | jinja2 | 3.1.5 | 1 |
| alerta/ | 4786b9eaa606 | jinja2 | 3.1.5 | 1 |
| alexvm6/ | 89a05786879c | jinja2 | 3.1.5 | 1 |
| allegroai/ | fca885e8cfc6 | jinja2 | 3.1.5 | 1 |
| anchore/ | bde9eedf639d | jinja2 | 3.1.5 | 1 |
| apache/ | 64e58748b6b9 | jinja2 | 3.1.5 | 1 |
| apache/ | ce90bdc3d2af | jinja2 | 3.1.5 | 1 |
| apache/ | e5560ad0b86e | jinja2 | 3.1.5 | 1 |
| apachepulsar/ | 16f9fdab3fa6 | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | jinja2 | 2.10.1-2ubuntu0.4 | 1 |
| apachepulsar/ | 9c9947de139d | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| apachepulsar/ | d056c89b7131 | jinja2 | 2.10.1-2ubuntu0.4 | 1 |
| apachepulsar/ | d538416d5afe | jinja2 | 2.10.1-2ubuntu0.4 | 1 |
| apache/ | 975ab033580d | jinja2 | 3.1.5 | 1 |
| apache/ | ab9467fd712c | jinja2 | 3.1.5 | 1 |
| aristidetm/ | 469dbc951224 | jinja2 | 3.1.5 | 1 |
| aristidetm/ | ccb516cb8474 | jinja2 | 3.1.5 | 1 |
| arthurjguerra18/ | f540af20b307 | jinja2 | 3.1.5 | 1 |
| assistiot/ | 792715dd3084 | jinja2 | 3.1.5 | 1 |
| assistiot/ | 44a37b00d4f8 | jinja2 | 3.1.5 | 1 |
| assistiot/ | a942dc14030a | jinja2 | 3.1.5 | 1 |
| assistiot/ | 38b003e55ff3 | jinja2 | 3.1.5 | 1 |
| assistiot/ | e32b87786142 | jinja2 | 3.1.5 | 1 |
| atlassian/ | 4af4bb6c8d46 | jinja2 | 3.1.5 | 1 |
| atlassian/ | 51c2d7274eef | jinja2 | 3.1.5 | 1 |