CVE-2014-1402: Jinja2 - Privilege Escalation via Crafted .cache File
Summary
CVE-2014-1402: The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting wi... Affects jinja2 versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Also tracked for
- jinja2 · Debian:11
The same CVE-2014-1402 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jinja2 is a popular templating engine for Python, widely used for generating dynamic web content. It provides a flexible and secure way to separate logic from presentation in web applications. Jinja2 allows developers to create templates with placeholders that can be dynamically filled with data. These templates are then rendered to produce the final output. However, a vulnerability in the default configuration of Jinja2's bccache.FileSystemBytecodeCache module allows local users to gain privileges by exploiting a flaw in the creation of temporary files. Specifically, a crafted .cache file with a name starting with '_jinja2' in the '/tmp' directory can be used to escalate privileges.
Vulnerability Detail
The vulnerability (CVE-2014-1402) arises from the improper handling of temporary files by the bccache.FileSystemBytecodeCache module in Jinja2. When creating temporary files, the module fails to follow secure practices, enabling local users to manipulate the file creation process. By crafting a .cache file with a name starting with '_jinja2' in the '/tmp' directory, an attacker can exploit this vulnerability to gain elevated privileges on the affected system. This privilege escalation can lead to unauthorized access, data theft, or further compromise of the system.
How To Fix
Latest published version: 3.1.6 as of 23 Oct 2026
pip install --upgrade "jinja2==3.1.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.2
This is the first release that contains the fix.
pip install --upgrade "jinja2==2.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Jinja2 is not immediately feasible, a possible workaround is to manually modify the default configuration of the bccache.FileSystemBytecodeCache module. By adjusting the temporary file creation process to follow secure practices, the vulnerability can be mitigated. However, it is strongly recommended to upgrade to the fixed version as soon as possible, as manual modifications may introduce errors or be incomplete. Here is an example of how the configuration can be modified:
import jinja2
jinja2.defaults.BYTECODE_CACHE = jinja2.bccache.FileSystemBytecodeCache('/secure/tmp')
In this example, the temporary file directory is changed to '/secure/tmp', which should be a directory with restricted access to prevent unauthorized manipulation of temporary files.
Conclusion
The vulnerability (CVE-2014-1402) in Jinja2's bccache.FileSystemBytecodeCache module allows local users to gain privileges by exploiting a flaw in the creation of temporary files. To mitigate this vulnerability, it is crucial to upgrade Jinja2 to version 2.7.2 or later. Alternatively, a temporary workaround can be applied by modifying the module's configuration. However, upgrading to the fixed version is strongly recommended. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jinja2 →
FAQ
Jinja2 is a popular templating engine for Python, used to generate dynamic web content. It provides a flexible and secure way to separate logic from presentation in web applications.
This vulnerability allows local users to escalate their privileges on the affected system. By exploiting the flaw in the creation of temporary files, an attacker can gain unauthorized access, steal data, or further compromise the system.
To fix this vulnerability, it is recommended to upgrade Jinja2 to version 2.7.2 or later. This upgrade includes improvements to the creation of temporary files, mitigating the privilege escalation vulnerability.
If immediate upgrading is not possible, a workaround is to manually modify the configuration of the bccache.FileSystemBytecodeCache module. By adjusting the temporary file creation process to follow secure practices, the vulnerability can be mitigated. However, upgrading to the fixed version is strongly recommended.
While specific exploits for this vulnerability are not provided, it is important to address this issue promptly by upgrading Jinja2 to the fixed version. Delaying the upgrade increases the risk of privilege escalation attacks.
Related vulnerabilities
Recent vulnerabilities recorded for jinja2.
