Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-27492 State: PUBLISHED Published: 2025-04-08T17:24:03.322Z Last Updated: 2025-06-04T17:53:17.033Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally
synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27492
CVE ID: CVE-2025-27493 State: PUBLISHED Published: 2025-03-11T09:48:32.888Z Last Updated: 2025-03-11T13:23:01.779Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SiPass integrated AC5102 (ACC-G2), SiPass integrated ACC-AP Problem Types: CWE-20 Description: A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrator to escalate privileges by injecting arbitrary commands that are executed with root
an authenticated local administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-515903.html
CVE ID: CVE-2025-27494 State: PUBLISHED Published: 2025-03-11T09:48:34.182Z Last Updated: 2025-03-11T13:21:07.671Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SiPass integrated AC5102 (ACC-G2), SiPass integrated ACC-AP Problem Types: CWE-20 Description: A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges. Additi
mote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-515903.html
CVE ID: CVE-2025-27495 State: PUBLISHED Published: 2025-04-16T17:37:22.667Z Last Updated: 2025-04-17T14:27:03.989Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: TeleControl Server Basic Problem Types: CWE-89 Description: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateTrace' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack re
te to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25911) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-443402.html
CVE ID: CVE-2025-27496 State: PUBLISHED Published: 2025-03-13T19:01:33.295Z Last Updated: 2025-03-13T19:51:10.678Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snowflakedb Products: snowflake-jdbc Problem Types: CWE-532 Description: Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data
e target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. Snowflake fixed the issue in version 3.23.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-q298-375f-5q63 - https://github.com/snowflakedb/snowflake-jdbc/commit/ef81582ce2f1dbc3c8794a696c94f4fe65fad507
CVE ID: CVE-2025-27497 State: PUBLISHED Published: 2025-03-05T15:59:01.702Z Last Updated: 2025-03-05T16:16:49.762Z Vendors: OpenIdentityPlatform Products: OpenDJ Problem Types: CWE-835 Description: OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption.
, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593 - https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf
CVE ID: CVE-2025-27498 State: PUBLISHED Published: 2025-03-03T16:52:02.750Z Last Updated: 2025-03-03T17:32:24.640Z Vendors: RustCrypto Products: AEADs Problem Types: CWE-347 Description: aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertext) is exposed even if the tag is incorrect. This is because in decrypt_inplace in asconcore.rs, tag verification causes an error to be returned with the plaintext contents still in buffer. The vulnerability is fixed in 0.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RustCrypto/AEADs/security/advisories/GHSA-r38m-44fw-h886 - http
CISA ADP Vulnrichment: References: - https://github.com/RustCrypto/AEADs/security/advisories/GHSA-r38m-44fw-h886 - https://github.com/RustCrypto/AEADs/commit/d1d749ba57e38e65b0e037cd744d0b17f7254037
CVE ID: CVE-2025-27499 State: PUBLISHED Published: 2025-03-03T18:23:28.229Z Last Updated: 2025-03-04T16:39:17.182Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the processa_edicao_socio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio_nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed
tically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf - https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc
CVE ID: CVE-2025-27500 State: PUBLISHED Published: 2025-03-03T18:30:48.198Z Last Updated: 2025-03-03T20:22:19.785Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: openziti Products: ziti-console Problem Types: CWE-79 Description: OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL. This can lead to a stored cross site scripting attack if the file uploaded contains malicious code and is then accessed and executed with
a stored cross site scripting attack if the file uploaded contains malicious code and is then accessed and executed within the context of the user's browser. This function is no longer necessary as the ziti-console moves from a node server application to a single page application, and has been disabled. The vulnerability is fixed in 3.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openziti/ziti-console/security/advisories/GHSA-frxm-vm48-5qf2
CVE ID: CVE-2025-27501 State: PUBLISHED Published: 2025-03-03T18:33:19.670Z Last Updated: 2025-03-03T19:10:02.275Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: openziti Products: ziti-console Problem Types: CWE-918 Description: OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side request, resulting in a potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external cont
potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external controller from the server side to the client side, thereby eliminating the identity of the node from being used to gain any additional permissions. This vulnerability is fixed in 3.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openziti/ziti-console/security/advisories/GHSA-fqxh-vfv5-8qjp
CVE ID: CVE-2025-27505 State: PUBLISHED Published: 2025-06-10T14:52:19.499Z Last Updated: 2025-06-10T15:01:45.132Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-862 Description: GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}
in extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5 - https://github.com/geoserver/geoserver/pull/8170 - https://osgeo-org.atlassian.net/browse/GEOS-11664 - https://osgeo-org.atlassian.net/browse/GEOS-11776
CVE ID: CVE-2025-27506 State: PUBLISHED Published: 2025-03-06T18:52:10.371Z Last Updated: 2025-03-06T19:19:39.656Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: nocodb Products: nocodb Problem Types: CWE-79 Description: NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to implementation of the client-side template engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which
emplate engine ejs, specifically on file resetPassword.ts where the template is using the insecure function “<%-“, which is rendered by the function renderPasswordReset. This vulnerability is fixed in 0.258.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nocodb/nocodb/security/advisories/GHSA-wf6c-hrhf-86cw - https://github.com/nocodb/nocodb/commit/ea821edb133e621e26183ae65c8ff9ee5d6f2723 - https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/auth.controller.ts#L251 - https://github.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPass
ithub.com/nocodb/nocodb/blob/ba5a191b33259d984fc92df225f7d82ede2ddb56/packages/nocodb/src/modules/auth/ui/auth/resetPassword.ts#L71
CVE ID: CVE-2025-27507 State: PUBLISHED Published: 2025-03-04T16:43:22.529Z Last Updated: 2025-03-12T21:11:10.878Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: zitadel Products: zitadel Problem Types: CWE-639 Description: The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not ut
affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x - https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4
CVE ID: CVE-2025-27508 State: PUBLISHED Published: 2025-03-05T21:32:42.470Z Last Updated: 2025-03-07T18:02:15.614Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: NationalSecurityAgency Products: emissary Problem Types: CWE-327 Description: Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cry
valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hw43-fcmm-3m5g - https://github.com/NationalSecurityAgency/emissary/commit/da3a81a8977577597ff2a944820a5ae4e9762368
CVE ID: CVE-2025-27509 State: PUBLISHED Published: 2025-03-06T19:00:36.098Z Last Updated: 2025-03-06T19:29:47.248Z Vendors: fleetdm Products: fleet Problem Types: CWE-285 Description: fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrollment is enabled. This vulnerability is fixed in 4.64.2, 4.63.2, 4.62.4, and 4.58.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.co
n 4.64.2, 4.63.2, 4.62.4, and 4.58.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fleetdm/fleet/security/advisories/GHSA-52jx-g6m5-h735 - https://github.com/fleetdm/fleet/commit/718c95e47ad010ad6b8ceb3f3460e921fbfc53bb
CVE ID: CVE-2025-27510 State: PUBLISHED Published: 2025-03-04T21:48:12.688Z Last Updated: 2025-03-05T16:37:33.675Z Vendors: conda-forge Products: conda-forge-metadata Problem Types: CWE-829 Description: conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conda-forge/conda-forge-metadata/security/advisories/GHSA-vwfh-m3q7-9jpw - https://github.com/c
es: - https://github.com/conda-forge/conda-forge-metadata/security/advisories/GHSA-vwfh-m3q7-9jpw - https://github.com/conda-forge/conda-forge-metadata/blob/799aee36b21ee06289d73d57838b28201f5a57af/pyproject.toml#L28
CVE ID: CVE-2025-27512 State: PUBLISHED Published: 2025-03-17T14:46:28.219Z Last Updated: 2025-03-17T15:01:42.057Z Vendors: coreos Products: zincati Problem Types: CWE-783, CWE-863 Description: Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice,
oadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, con
Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825 - https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78 - https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d - https://github.com/coreos/zincati/releases/t
github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d - https://github.com/coreos/zincati/releases/tag/v0.0.24 - https://github.com/coreos/zincati/releases/tag/v0.0.30
CVE ID: CVE-2025-27513 State: PUBLISHED Published: 2025-03-05T18:12:25.867Z Last Updated: 2025-03-05T18:45:40.868Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: open-telemetry Products: opentelemetry-dotnet Problem Types: CWE-770 Description: OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that
rs can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-8785-wc3w-h8q6 - https://github.com/open-telemetry/opentelemetry-dotnet/commit/1b555c1201413f2f55f2cd3c4ba03ef4b615b6b5
CVE ID: CVE-2025-27514 State: PUBLISHED Published: 2025-07-29T17:39:28.813Z Last Updated: 2025-07-29T18:35:50.874Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-80, CWE-79 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-jh8j-
nalyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-jh8j-gqxc-6gqj - https://github.com/glpi-project/glpi/commit/c340a64a11343bde706d1cd41e4be798dd922303
CVE ID: CVE-2025-27515 State: PUBLISHED Published: 2025-03-05T18:45:50.101Z Last Updated: 2025-03-05T18:59:49.627Z Vendors: laravel Products: framework Problem Types: CWE-155 Description: Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/laravel/framework/security/advisories/GHSA-78fx-h6xr-vch4 - https://github.com/laravel/framework/commit/2d133034fefddfb047838f4caca3687a3ba811a5
CVE ID: CVE-2025-27516 State: PUBLISHED Published: 2025-03-05T20:40:06.568Z Last Updated: 2025-11-03T19:45:35.548Z Vendors: pallets Products: jinja Problem Types: CWE-1336 Description: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to s
his vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7 - https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403