Skip to content
OpenAdvisories

Vendor

pallets

18 known vulnerabilities.

Products

werkzeug 10 jinja 5 flask 3 Quart 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug werkzeug py3-werkzeug Alpine PyPI
  • Medium 5.4
    CVE-2024-34064 Public exploit

    Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

    Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

    pallets jinja jinja2 jinja2 Debian Ubuntu Alpine PyPI