{"action":"Upgrade jinja2 to 3.1.4 or later.","affected":[{"fixed":"3.1.4","introduced":"0"}],"component":"jinja2","cve_ids":["CVE-2024-34064"],"ecosystem":"PyPI","epss":0.00979,"exploited":false,"fixed_versions":["3.1.4"],"ghsa_id":"GHSA-h75v-3vvj-5mfj","id":"tcs_01M5KGSTTD5DH4SG88D7A40590","modified_at":"2026-07-07T17:46:13.832160246Z","published_at":"2026-07-07T11:45:41.875280Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1474","https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","https://nvd.nist.gov/vuln/detail/CVE-2024-34064","https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb","https://github.com/pallets/jinja","https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS","https://pypi.org/project/jinja2","https://github.com/advisories/GHSA-h75v-3vvj-5mfj"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1474","url":"https://osv.dev/vulnerability/PYSEC-2026-1474"}],"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter"}