An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "sour…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 5

• SUSE-SU-2019:1156-1 Security update for python-Jinja2 SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2019:1554-1 Security update for python-Jinja2 SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2020:3897-1 Security update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark SUSE / openSUSE Security Updates · Feb 4, 2026
• openSUSE-SU-2019:1395-1 Security update for python-Jinja2 SUSE / openSUSE Security Updates · Feb 4, 2026
• SUSE-SU-2020:3096-1 Security update for python-Jinja2 SUSE / openSUSE Security Updates · Feb 4, 2026

References

• https://github.com/JameelNabbo/Jinja2-Code-execution
• 46386 exploit
• openSUSE-SU-2019:1395 vendor-advisory
• openSUSE-SU-2019:1614 vendor-advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1677653
• https://bugzilla.suse.com/show_bug.cgi?id=1125815