CVE-2019-10906: Jinja2 - Sandbox Escape
Summary
CVE-2019-10906: Jinja2 sandbox escape via string formatting. Affects jinja2 versions < 2.10.1. Fixed in 2.10.1. How to fix ↓
Also tracked for
- jinja2 · Debian:11
The same CVE-2019-10906 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jinja2 is a popular templating engine for Python applications. It provides a powerful and flexible way to generate dynamic content. However, versions before 2.10.1 are vulnerable to a high severity issue that allows a sandbox escape through the str.format_map function.
Vulnerability Detail
The vulnerability in Jinja2 arises from the str.format_map function, which can be exploited to escape the sandbox. This can lead to unauthorized access, data leakage, or arbitrary code execution. The issue has a CVSS score of 8.6, indicating a high severity level.
How To Fix
Latest published version: 3.1.6 as of 23 Oct 2026
pip install --upgrade "jinja2==3.1.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.1
This is the first release that contains the fix.
pip install --upgrade "jinja2==2.10.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of Jinja2 to ensure the security of your application.
Conclusion
In conclusion, the Jinja2 package before version 2.10.1 is vulnerable to a high severity issue that allows a sandbox escape. It is crucial to update to the patched version to ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for jinja2 →
FAQ
Jinja2 is a templating engine for Python, commonly used in web development to generate dynamic content.
The vulnerability allows a sandbox escape, potentially leading to unauthorized access, data leakage, or arbitrary code execution.
To fix this vulnerability, you need to update Jinja2 to version 2.10.1 or later using the command pip install --upgrade jinja2.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jinja2.
