Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-56201

27
FAUCET Score

CVE-2024-56201 is a high-severity vulnerability affecting Jinja versions prior to 3.1.5, allowing arbitrary Python code execution. An attacker must control both the template content and filename to exploit this flaw, bypassing Jinja's sandbox. The CVSS score is 8.8, indicating a local attack vector with low complexity and high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion beyond a single GitHub mention.

Impacted Technologies

VendorProductVersion(s)CPE
>= 3.0.0, < 3.1.5CPE matchmatch criteria
cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

5.4MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
PASSIVE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.31%
Probability of exploitation in next 30 days
EPSS Percentile
22.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0031 is in the 59th percentile among its peer group of 16,974 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (67)

esetpatch availablevia llm_extracted
Fixed in: 4.2.3
View patch
github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: azl3 python-jinja2 3.1.2-2 on Azure Linux 3.0Fixed in: 3.1.2-2
microsoftpatch availablevia msrc
Product: cbl2 python-jinja2 3.0.3-7 on CBL Mariner 2.0Fixed in: 3.0.3-5
microsoftpatch availablevia msrc
Product: cbl2 python-jinja2 3.0.3-5 on CBL Mariner 2.0Fixed in: 3.0.3-5
microsoftpatch availablevia msrc
Product: 19400-17084Fixed in: 3.1.2-2
microsoftpatch availablevia msrc
Product: 17499-17084Fixed in: 3.1.2-2
microsoftpatch availablevia msrc
Product: 19846-17086Fixed in: 3.0.3-5
microsoftpatch availablevia msrc
Product: 17125-16823Fixed in: 3.0.3-5
microsoftpatch availablevia msrc
Product: azl3 python-jinja2 3.1.2-3 on Azure Linux 3.0Fixed in: 3.1.2-2
pippatch availablevia ghsa
Product: jinja2Fixed in: 3.1.5
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed in: ansible-automation-platform-24/lightspeed-rhel8-operator:2.4-33
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed in: automation-controller-0:4.5.17-1.el9ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed in: python-jinja2-0:3.1.5-1.el9ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed in: ansible-automation-platform-25/lightspeed-rhel8:2.5.250107-1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed in: automation-controller-0:4.6.7-1.el8ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed in: python3.11-jinja2-0:3.1.5-1.el8ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed in: automation-controller-0:4.6.7-1.el9ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed in: python3.11-jinja2-0:3.1.5-1.el9ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Developer Hub 1.3 on RHEL 9Fixed in: rhdh-hub-container-1.3-138
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: fence-agents-0:4.10.0-76.el9_5.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: fence-agents-0:4.10.0-20.el9_0.20
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: fence-agents-0:4.10.0-43.el9_2.11
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: fence-agents-0:4.10.0-62.el9_4.10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.15Fixed in: python-jinja2-0:3.0.1-6.el9.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.16Fixed in: openshift4/ose-ansible-rhel9-operator:v4.16.0-202501311735.p0.g2cb0020.assembly.stream.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.16Fixed in: python-jinja2-0:3.0.1-6.el9.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.17Fixed in: openshift4/ose-ansible-rhel9-operator:v4.17.0-202501300634.p0.g9cb5839.assembly.stream.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.17Fixed in: python-jinja2-0:3.1.5-1.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenStack Platform 17.1 for RHEL 9Fixed in: openstack-ansible-core-0:2.14.2-4.6.el9ost
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Satellite 6.15 for RHEL 8Fixed in: python-jinja2-0:3.1.5-1.el8pc
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Developer Hub 1.5Fixed in: rhdh/rhdh-hub-rhel9:sha256:56bfbb2328f42e91d0462e142f3434e5d771737defbc07d8a21dbdf50e468665
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Developer Hub (RHDH) 1.4Fixed in: rhdh/rhdh-hub-rhel9:sha256:d8268197ba0466643efb818fcad8f0fc29e32463f75b0f7f51d9ce75ec717572
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift AI 2.16Fixed in: rhoai/odh-model-registry-rhel8:sha256:de5f91180ead7d73a1825fe8b032fde9b8b01392569c9789f5ce1b4b9c08a98f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.14Fixed in: python-jinja2-0:3.0.1-6.el9.2
View patch
redhatpatch availablevia redhat_api
Product: Ansible Automation Platform Execution EnvironmentsFixed in: ansible-automation-platform/ee-minimal-rhel8:2.18.1-3
View patch
redhatpatch availablevia redhat_api
Product: Ansible Automation Platform Execution EnvironmentsFixed in: ansible-automation-platform/ee-minimal-rhel9:2.18.1-4
View patch
redhatpatch availablevia redhat_api
Product: Ansible Automation Platform Execution EnvironmentsFixed in: ansible-automation-platform/ee-minimal-rhel8:2.13.10-39
View patch
redhatpatch availablevia redhat_api
Product: Ansible Automation Platform Execution EnvironmentsFixed in: ansible-automation-platform/ee-minimal-rhel9:2.15.13-10
View patch
redhatpatch availablevia redhat_api
Product: Discovery 1 for RHEL 9Fixed in: discovery/discovery-server-rhel9:1.12.0-1
View patch
redhatpatch availablevia redhat_api
Product: Discovery 1 for RHEL 9Fixed in: discovery/discovery-ui-rhel9:1.12.0-1
View patch
redhatpatch availablevia redhat_api
Product: Ironic content for Red Hat OpenShift Container Platform 4.12Fixed in: python-jinja2-0:3.0.1-6.el9.2
View patch
redhatpatch availablevia redhat_api
Product: Ironic content for Red Hat OpenShift Container Platform 4.13Fixed in: python-jinja2-0:3.0.1-6.el9.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed in: automation-controller-0:4.5.17-1.el8ap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed in: python3x-jinja2-0:3.1.5-1.el8ap
View patch
redhatno patchvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed-tech-preview/lightspeed-service-api-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-ovn-kubernetes-microshift-rhel9
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ztp-site-generate-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/opentelemetry-collector-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/opentelemetry-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/opentelemetry-rhel8-operator
redhatno patchvia redhat_api
Product: Red Hat OpenStack Platform 18.0Fixed in: python-jinja2
redhatno patchvia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-nvidia-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-aws-nvidia-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/opentelemetry-target-allocator-rhel8
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-amd-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Ansible Automation Platform 1.2Fixed in: ansible-tower
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-intel-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/instructlab-amd-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/instructlab-intel-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/instructlab-nvidia-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-ovn-kubernetes
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-ibm-nvidia-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-gcp-nvidia-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-azure-nvidia-rhel9
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux AI (RHEL AI)Fixed in: rhelai1/bootc-azure-amd-rhel9

Vendor Advisories (4)

esetllm-eset-633ddbad236cf4deCRITICAL

Third-Party Package Updates in Python for Scientific Computing - June 2025

Jun 12, 2025
pipGHSA-gmj6-6f8f-6699medium

Jinja has a sandbox breakout through malicious filenames

Dec 23, 2024
redhatCVE-2024-56201Important

jinja2: Jinja has a sandbox breakout through malicious filenames

Dec 23, 2024
microsoft2024-Dec/CVE-2024-56201Moderate

Jinja has a sandbox breakout through malicious filenames

Dec 10, 2024

References

github.com / pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f
Patch
github.com / pallets/jinja/issues/1792
Issue Tracking
github.com / pallets/jinja/releases/tag/3.1.5
Release Notes
github.com / pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699
Vendor Advisory