CVE-2025-27516: Jinja sandbox breakout through attr filter selecting format method
An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code.
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup.
Other sources
Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Jinja2to a version that resolves this vulnerability.Fixed in 3.1.6 - Upgrade
Upgrade
debian/jinja2to a version that resolves this vulnerability.Fixed in 2.11.3-1+deb11u4Fixed in 3.1.6-1 - Upgrade
Upgrade
Jinjato a version that resolves this vulnerability.Fixed in 3.1.6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27516?
CVE-2025-27516 is rated as a critical vulnerability due to its potential to enable arbitrary code execution.
How do I fix CVE-2025-27516?
To mitigate CVE-2025-27516, upgrade Jinja2 to version 3.1.6 or later.
Who is affected by CVE-2025-27516?
CVE-2025-27516 affects users of Jinja2 versions 3.1.5 and earlier.
What does CVE-2025-27516 allow an attacker to do?
CVE-2025-27516 allows an attacker to execute arbitrary Python code through controlled template content.
How can I identify if I'm vulnerable to CVE-2025-27516?
You can identify if you're vulnerable to CVE-2025-27516 by checking if you are using Jinja2 version 3.1.5 or earlier.