CVE-2019-8341

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

• CWE-94

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1677653Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1125815Issue Tracking, Third Party Advisory
• https://github.com/JameelNabbo/Jinja2-Code-executionBroken Link
• https://www.exploit-db.com/exploits/46386/Exploit, Third Party Advisory, VDB Entry
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1677653Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1125815Issue Tracking, Third Party Advisory
• https://github.com/JameelNabbo/Jinja2-Code-executionBroken Link
• https://www.exploit-db.com/exploits/46386/Exploit, Third Party Advisory, VDB Entry

Published

Feb 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-8334An issue was discovered in SchoolCMS 2.3.1. There is an XSS …
• CVE-2019-8335An issue was discovered in SchoolCMS 2.3.1. There is an XSS …
• CVE-2019-8336HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 …
• CVE-2019-8337In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its d…
• CVE-2019-8338The signature verification routine in the Airmail GPG-PGP Pl…
• CVE-2019-8339An issue was discovered in Falco through 0.14.0. A missing i…
• CVE-2019-8342A Local Privilege Escalation in libqcocoa.dylib in Foxit Rea…
• CVE-2019-8343In Netwide Assembler (NASM) 2.14.02, there is a use-after-fr…
• CVE-2019-8345The Help feature in the ES File Explorer File Manager applic…
• CVE-2019-8346In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an…
• CVE-2019-8347BEESCMS 4.0 has a CSRF vulnerability to add arbitrary VIP ac…
• CVE-2019-8349Multiple cross-site scripting (XSS) vulnerabilities in HTMLy…