CVE-2024-34064

CVE-2024-34064 is a medium-severity vulnerability in the Jinja templating engine, affecting fedoraproject and palletsprojects distributions, where the xmlattr filter improperly handles non-attribute characters in user-supplied keys, potentially leading to Cross-Site Scripting (XSS). An attacker could exploit this by injecting malicious attributes if an application accepts keys as user input and renders them without proper validation. The vulnerability has a CVSS score of 5.4, indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.