CVE-2025-27516
Palletsprojects Jinja ≤ 3.1.6
Raw vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-27516 is a medium-severity Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerability in Palletsprojects Jinja. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Template Injection (T1221); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-27516 is a sandbox escape vulnerability in Jinja, an extensible templating engine for Python, affecting versions prior to 3.1.6. The issue stems from an oversight in how the Jinja sandboxed environment handles the |attr filter, which allows an attacker controlling the content of a template to execute arbitrary Python code. Specifically, while the sandbox blocks calls to str.format to prevent escapes, the |attr filter can be used to obtain a reference to a string's underlying format method, bypassing these restrictions. This impacts applications that use Jinja to execute untrusted templates.
An attacker must control the content of a template rendered by a vulnerable Jinja instance to exploit this flaw, with feasibility depending on the application's design—such as web apps allowing user-supplied templates. Exploitation enables arbitrary Python code execution within the sandboxed context. The CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a local attacker with low privileges requiring low complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability due to the changed scope.
The vulnerability is fixed in Jinja 3.1.6, where the |attr filter no longer bypasses the environment's attribute lookup restrictions. Official advisories, including the GitHub security advisory (GHSA-cpwx-vrp4-4pq7) and the associated commit, detail the patch. Debian LTS announcements confirm backported fixes for affected distributions. Security practitioners should upgrade to Jinja 3.1.6 or later and audit applications for untrusted template execution.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6152
Vulnerability Data
Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the…
more
vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.2V1.3.7V1.3.10
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static analysis can discover missing neutralization of template directives.
Input validation rejects or sanitizes untrusted data before it reaches the template engine, stopping injection of special syntax.
Security engineering principles require use of safe templating APIs and proper escaping of external input.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization in template engines to prevent injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect template-injection flaws but does not itself implement neutralization controls.
Secure development life cycle mandates input validation and sanitization that directly prevents template-injection weaknesses.
Application security requirements explicitly call for neutralizing special elements in template engines.
Secure architecture principles reduce the likelihood of unsafe template processing but do not prescribe specific neutralization techniques.
Secure coding standards require proper escaping or sandboxing of template directives, directly mitigating CWE-1336.