-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Jinja2 | pip | <= 3.1.5 | 3.1.6 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly points to the |attr filter as the source of the sandbox bypass. The provided commit 90457bbf33b8662926ae65cdde4c4c32e756e403 modifies the do_attr function in src/jinja2/filters.py. This function is the Python implementation of the |attr filter in Jinja2. The changes in the patch show that the way attributes were accessed was altered to ensure the environment's attribute lookup (which includes sandboxing) is used, specifically by calling environment.getattr. The previous implementation directly used getattr, which, in combination with how str.format was handled, allowed the bypass. Therefore, the do_attr function, in its state before this patch, is the vulnerable function.
PythonPythonOngoing coverage of React2Shell