CVE-2024-56326
HighAdvisory
Published 23 Dec 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.8
- base score, highest
- EPSS
- 0.005
- 43rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 374
- of 17,781 indexed, latest versions
- Container images
- 401
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Jinja has a sandbox breakout through indirect reference to format method
Carried by container images the latest versions of 374 of 17,781 indexed charts deploy, on 401 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jinja2pypi | 2.7.2, 2.8, 2.8.1, 2.9.4+16 more | 3.1.5 | 401 |
| jinja2deb | 2.7.2-2, 2.10.1-2, 3.0.3-1, 3.0.3-1ubuntu0.1+1 more | 2.7.2-2ubuntu0.1~esm6, 2.10.1-2ubuntu0.4, 3.0.3-1ubuntu0.3 | 13 |
| py3-jinja2apk | 3.1.2-r2 | 3.1.5-r0 | 1 |
- OSV records
- GHSA-q2x7-8rv6-6q7hUBUNTU-CVE-2024-56326ALPINE-CVE-2024-56326
- Also known as
- PYSEC-2026-1475, USN-7244-1, USN-7343-1
Charts affected
374 by stars
Container images carrying it
401 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| anchore/ | ed9b3badd17c | jinja2 | 3.1.5 | 1 |
| ansiblesemaphore/ | 03d1f8684027 | jinja2 | 3.1.5 | 1 |
| apache/ | 64e58748b6b9 | jinja2 | 3.1.5 | 1 |
| apache/ | ce90bdc3d2af | jinja2 | 3.1.5 | 1 |
| apache/ | e5560ad0b86e | jinja2 | 3.1.5 | 1 |
| apachepulsar/ | 16f9fdab3fa6 | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | jinja2 jinja2 | 2.10.1-2ubuntu0.4 3.1.5 | 1 |
| apachepulsar/ | 4db6ff0b4045 | jinja2 | 3.1.5 | 1 |
| apachepulsar/ | 9c9947de139d | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| apachepulsar/ | d056c89b7131 | jinja2 jinja2 | 2.10.1-2ubuntu0.4 3.1.5 | 1 |
| apachepulsar/ | d538416d5afe | jinja2 jinja2 | 2.10.1-2ubuntu0.4 3.1.5 | 1 |
| apache/ | 975ab033580d | jinja2 | 3.1.5 | 1 |
| apache/ | ab9467fd712c | jinja2 | 3.1.5 | 1 |
| apsl/ | 51e2de5c2c70 | jinja2 | 3.1.5 | 1 |
| aristidetm/ | 469dbc951224 | jinja2 | 3.1.5 | 1 |
| aristidetm/ | ccb516cb8474 | jinja2 | 3.1.5 | 1 |
| arthurjguerra18/ | f540af20b307 | jinja2 | 3.1.5 | 1 |
| assistiot/ | 0aacefac9677 | jinja2 | 3.1.5 | 1 |
| assistiot/ | 792715dd3084 | jinja2 | 3.1.5 | 1 |
| assistiot/ | 44a37b00d4f8 | jinja2 | 3.1.5 | 1 |
| assistiot/ | a942dc14030a | jinja2 | 3.1.5 | 1 |
| assistiot/ | 38b003e55ff3 | jinja2 | 3.1.5 | 1 |
| assistiot/ | e32b87786142 | jinja2 | 3.1.5 | 1 |
| atlassian/ | 4af4bb6c8d46 | jinja2 | 3.1.5 | 1 |
| atlassian/ | 51c2d7274eef | jinja2 | 3.1.5 | 1 |
| atlassian/ | 05933f2b1cfd | jinja2 | 3.1.5 | 1 |
| atlassian/ | 3b9222ab32ef | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| atlassian/ | c81cc7d6bc9e | jinja2 | 3.1.5 | 1 |
| atlassian/ | ebf761c7d437 | jinja2 | 3.1.5 | 1 |
| atlassian/ | 37bc46cbec1a | jinja2 jinja2 | 3.0.3-1ubuntu0.3 3.1.5 | 1 |
| atlassian/ | 64a75aa4ec4e | jinja2 | 3.1.5 | 1 |
| atlassian/ | e5548cd4eea8 | jinja2 | 3.1.5 | 1 |
| avinash263/ | aa2b8727f1a6 | jinja2 | 3.1.5 | 1 |
| azhar008/ | a1e827b0adea | jinja2 | 3.1.5 | 1 |
| badsmoke/ | c54c004f24cc | jinja2 | 3.1.5 | 1 |
| behnambm/ | bd3ad88afff9 | jinja2 | 3.1.5 | 1 |
| benbusby/ | f77f7e6e4ad2 | jinja2 | 3.1.5 | 1 |
| blakeblackshear/ | ae269270ad9e | jinja2 | 3.1.5 | 1 |
| bootc/ | f1383295e7be | jinja2 | 3.1.5 | 1 |
| buntha/ | 154542cc3083 | jinja2 | 3.1.5 | 1 |
| camptocamp/ | 35c91d5fda04 | jinja2 | 3.1.5 | 1 |
| cbanuka/ | c742770d4247 | jinja2 | 3.1.5 | 1 |
| ceph/ | 90f30824a96e | jinja2 | 3.1.5 | 1 |
| cheyang/ | 46cc34755493 | jinja2 | 3.1.5 | 1 |
| chorss/ | 5c549cacb8ab | jinja2 | 3.1.5 | 1 |
| citizenstig/ | b81c818ccb86 | jinja2 | 3.1.5 | 1 |
| cleveritcz/ | c75c1636e0b7 | jinja2 | 3.1.5 | 1 |
| clowder/ | 11f3d844e4c0 | jinja2 | 3.1.5 | 1 |
| clowder/ | 14155326c7b9 | jinja2 | 3.1.5 | 1 |
| clowder/ | bf146f1ca24f | jinja2 | 3.1.5 | 1 |