6.1

CVE-2024-22195: Jinja vulnerable to Cross-Site Scripting (XSS)

Modified
AliasesALPINE-CVE-2024-22195GHSA-h5c8-rqwp-cp95PYSEC-2026-1473
Published 11-01-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-22195 is a medium (CVSS 6.1) vulnerability in pallets jinja. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 59.4% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
0.89%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 27 · Related 17
DLA-3988-1MGASA-2024-0199OPENSUSE-SU-2026:11992-1RHBA-2024:1091RHBA-2024:1114RHBA-2024:1137

Timeline

  1. 11-01-2024
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

CVSS metrics

9 scores · 9 sources · 1 version

EPSS trend

Probability

0.89%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.89% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat56 products
  • fence-agents< 0:4.2.1-121.el8_9.4 | < 0:4.2.1-112.el8_8.3
  • fence-agents-aliyun< 0:4.2.1-121.el8_9.4 | < 0:4.2.1-112.el8_8.3
  • fence-agents-aliyun-debuginfo< 0:4.2.1-121.el8_9.4 | < 0:4.2.1-112.el8_8.3
  • fence-agents-all< 0:4.2.1-121.el8_9.4 | < 0:4.2.1-112.el8_8.3
  • fence-agents-amt-ws< 0:4.2.1-121.el8_9.4 | < 0:4.2.1-112.el8_8.3
Chainguard9 products
  • checkov< 3.0.34-r1
  • kubeflow-pipelines-visualization-server< 2.4.0-r0
  • py3-jinja2< 3.1.3-r1
  • py3-supported-jinja2< 3.1.3-r1
  • py3.10-jinja2< 3.1.3-r1
Wolfi9 products
  • checkov< 3.0.34-r1
  • kubeflow-pipelines-visualization-server< 2.4.0-r0
  • py3-jinja2< 3.1.3-r1
  • py3-supported-jinja2< 3.1.3-r1
  • py3.10-jinja2< 3.1.3-r1
Alpine1 product
  • py3-jinja2< 3.1.4-r0 | < 3.1.3-r0
Debian1 product
  • jinja2< 2.10-2+deb10u1 | < 3.1.2-1+deb12u1 | < 3.1.3-1
Opensuse1 product
  • python-Jinja2&distro=openSUSE Tumbleweed< 3.1.3-1.1
Pallets1 product
Palletsprojects1 product
PyPI1 product
  • jinja2< 3.1.3
Ubuntu1 product
  • jinja2< 2.7.2-2ubuntu0.1~esm2 | < 2.8-1ubuntu0.1+esm2 | < 2.10-1ubuntu0.18.04.1+esm1 | < 2.10.1-2ubuntu0.2 | < 3.0.3-1ubuntu0.1 | < 3.1.2-1ubuntu1

10 vendors · 81 products

References

38 links
Show all 38 references