VYPR
← All advisories
High severityOSV Advisory· Published Apr 6, 2019· Updated Aug 4, 2024

CVE-2019-10906

CVE-2019-10906

Description

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A sandbox escape vulnerability in Jinja2 before 2.10.1 via str.format_map allows remote code execution.

CVE-2019-10906 is a sandbox escape vulnerability in the Jinja2 template engine (versions before 2.10.1). The issue stems from the str.format_map method, which can be exploited to bypass the sandboxed environment [1][3].

Exploitation requires an application that uses Jinja2's sandboxed environment and allows user-controlled format strings. By crafting a malicious format string, an attacker can escape the sandbox and execute arbitrary code [3].

The impact is severe: an attacker can execute arbitrary Python code, leading to full compromise of the application and potentially the host system [1][2]. Red Hat rated this vulnerability as Important severity.

Mitigation involves upgrading to Jinja2 version 2.10.1 or later. Red Hat has released patches for Red Hat Enterprise Linux via advisories RHSA-2019:1152, RHSA-2019:1329, and RHSA-2019:1237 [1][2][4]. Users should apply updates immediately.

References
  1. https://access.redhat.com/errata/RHSA-2019:1152
  2. https://access.redhat.com/errata/RHSA-2019:1329
  3. NVD - CVE-2019-10906
  4. https://access.redhat.com/errata/RHSA-2019:1237

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Jinja2PyPI
< 2.10.12.10.1

Affected products

77

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

35

News mentions

0

No linked articles in our index yet.