{"action":"Upgrade jinja2 to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"0"}],"component":"jinja2","cve_ids":["CVE-2024-34064"],"ecosystem":"PyPI","epss":0.00979,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-h75v-3vvj-5mfj","id":"tcs_01M5KFK3A5SP5H6BXSDRF90TNN","modified_at":"2026-09-10T03:50:13.786450101Z","published_at":"2024-05-06T14:20:59Z","references":["https://osv.dev/vulnerability/GHSA-h75v-3vvj-5mfj","https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","https://nvd.nist.gov/vuln/detail/CVE-2024-34064","https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb","https://github.com/pallets/jinja","https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-h75v-3vvj-5mfj","url":"https://osv.dev/vulnerability/GHSA-h75v-3vvj-5mfj"}],"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"}