StackPrism

PyPI package

Jinja2 vulnerabilities by version

The latest release, 3.1.6 (Mar 5, 2025), has no known vulnerabilities. 9 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 10 advisories for Jinja2; the newest was published on Mar 5, 2025.

PyPI (opens in a new tab) describes it as “A very fast and expressive template engine.”

Latest release
3.1.6
Mar 5, 2025, no known vulnerabilities
Downloads last week
147.1M
All versions, from pypistats.org
Advisories on OSV.dev
10
Newest Mar 5, 2025
Licence
BSD License
OpenSSF Scorecard
5.9/10
pallets/jinja (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
3.1.6latestMar 5, 2025No known vulnerabilities
3.1.5Dec 21, 20241 known vulnerability, worst rated warning
3.1.4May 5, 20243 known vulnerabilities, worst rated warning
3.1.3Jan 10, 20244 known vulnerabilities, worst rated warning
3.1.2Apr 28, 20225 known vulnerabilities, worst rated warning
3.1.1Mar 25, 20225 known vulnerabilities, worst rated warning
3.1.0Mar 24, 20225 known vulnerabilities, worst rated warning
3.0.3Nov 9, 20215 known vulnerabilities, worst rated warning
3.0.2Oct 5, 20215 known vulnerabilities, worst rated warning
3.0.1May 18, 20215 known vulnerabilities, worst rated warning

Release lines

The newest release of each minor line, from the registry. Jinja2 doesn’t publish support dates we can check.

LineNewest releaseReleased
3.13.1.6Mar 5, 2025
3.03.0.3Nov 9, 2021
2.112.11.3Jan 31, 2021
2.102.10.3Oct 4, 2019
2.92.9.6Apr 3, 2017
2.82.8.1Dec 29, 2016

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2025-27516 on OSV.dev (opens in a new tab)GHSA-cpwx-vrp4-4pq7

    Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

    Affects < 3.1.6. Published Mar 5, 2025.

  2. WarningCVE-2024-56326 on OSV.dev (opens in a new tab)GHSA-q2x7-8rv6-6q7h

    Jinja has a sandbox breakout through indirect reference to format method

    Affects < 3.1.5. Published Dec 23, 2024.

  3. WarningCVE-2024-56201 on OSV.dev (opens in a new tab)GHSA-gmj6-6f8f-6699

    Jinja has a sandbox breakout through malicious filenames

    Affects >= 3.0.0, < 3.1.5. Published Dec 23, 2024.

  4. WarningCVE-2024-34064 on OSV.dev (opens in a new tab)GHSA-h75v-3vvj-5mfj

    Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

    Affects < 3.1.4. Published May 6, 2024.

  5. WarningCVE-2024-22195 on OSV.dev (opens in a new tab)GHSA-h5c8-rqwp-cp95

    Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

    Affects < 3.1.3. Published Jan 11, 2024.

All 10 advisories are on OSV.dev (opens in a new tab).

Which Jinja2 do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for Jinja2, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.