Vulnerability record · CVE-2019-8341 · published 15 February 2019
CVE-2019-8341: Jinja2 from_string Server-Side Template Injection
PPocoo · Jinja2
Jinja2 2.10's from_string function treats the source parameter as a template, rendering it and returning the result, which allows Server-Side Template Injection when attacker-controlled input reaches it. The maintainer and third parties dispute the finding, arguing untrusted templates should not be used without sandboxing, so the practical risk depends on how the application uses the API.
Description
An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 9.8 and high EPSS with a public exploit, but the maintainer disputes validity and exploitation requires an application that passes untrusted input to from_string.
What it is
Jinja2 2.10's from_string function treats the source parameter as a template, rendering it and returning the result, which allows Server-Side Template Injection when attacker-controlled input reaches it. The maintainer and third parties dispute the finding, arguing untrusted templates should not be used without sandboxing, so the practical risk depends on how the application uses the API.
Impact
An attacker who can inject template syntax such as {{...}} into the source parameter can execute code in the context of the application, leading to full compromise of confidentiality, integrity and availability per the CVSS vector.
Attack surface
Reachable over the network via a URI carrying injected template syntax, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). It only applies where an application passes untrusted input into Jinja2's from_string.
Exploitation
Not listed in CISA KEV, but EPSS is 0.4478 (98.7th percentile) and a public Exploit-DB entry (46386) exists, indicating meaningful exploitation interest despite the disputed validity.
What to do
- Upgrade Jinja2 to a version after 2.10 if a fixed release is available for your deployment.
- Never pass untrusted input to from_string; render only trusted, developer-controlled templates.
- Use Jinja2's sandboxed environment (jinja2.sandbox) when templates must handle untrusted data.
- Apply the referenced openSUSE security updates for affected Leap packages.
- Validate and reject template metacharacters such as {{ and }} in user-supplied input reaching template rendering.
Detection
- Search application and web logs for URI or parameter values containing Jinja2 template syntax such as {{, }}, {% or %}.
- Monitor for unexpected outbound connections or process execution originating from the application server after template rendering.
- Review code and dependency scans for calls to Jinja2 from_string or Template with non-constant source arguments.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-8341 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-8341), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
