Arbitrary Code Execution in Jinja Templating Engine Affecting Pallets

CVE-2025-27516

What is CVE-2025-27516?

An oversight in the Jinja templating engine's sandboxed environment allows for arbitrary Python code execution by using the |attr filter in templates controlled by an attacker. This occurs in versions prior to 3.1.6, where the |attr filter improperly interacts with the sandbox, enabling the exploitation of untrusted templates. Applications leveraging Jinja must ensure they upgrade to version 3.1.6 or later to mitigate this risk, as the fix prevents bypassing the environment's attribute lookup, enhancing security against potential code execution threats.

References