Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pallets/jinja2
main @ 5ef7011
19
Fixes
3
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Sandbox Escape: 12 prior fixes. Scrutinize any change in this area.
jinja2/sandbox.py: most-fixed (8 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Attackers repeatedly find ways to bypass the SandboxedEnvironment boundaries by exploiting indirect execution vectors (e.g., format and format_map string methods, unblocked internal class attributes like generator frames or code objects, and string conversion flaws during attribute lookup). Ensure all attribute resolution routes through central sandbox validators.
Sandbox Escape: Bypasses occur when helper filters, such as the `attr` filter, use raw getattr operations that bypass the sandboxed environment's safety controls. The standard `getattr` must always delegate to the environment's lookup handler.
Insecure Temporary File: The bytecode cache mechanisms previously utilized predictable shared temporary directories, allowing local attackers to hijack cache files or pre-create key directories to escalate privileges. Directory generation must utilize user-restricted permissions (mode 0700) and enforce strict owner verification.