How severe is CVE-2024-22195?

CVE-2024-22195 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2024-22195 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-22195?

CVE-2024-22195 affects Palletsprojects Jinja. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-22195?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-22195 have an EU (EUVD) identifier?

Yes. CVE-2024-22195 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0365.

When was CVE-2024-22195 published?

CVE-2024-22195 was published on 2024-01-11 and last updated on 2026-06-17.

CVE-2024-22195

CVE-2024-22195 is a medium-severity vulnerability in Palletsprojects Jinja with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-0365
Weakness: CWE-79
Affected product: Palletsprojects Jinja
Published: 2024-01-11
Last modified: 2026-06-17

Description

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Frequently asked questions

What is CVE-2024-22195?: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
How severe is CVE-2024-22195?: CVE-2024-22195 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2024-22195 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-22195?: CVE-2024-22195 affects Palletsprojects Jinja. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-22195?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-22195 have an EU (EUVD) identifier?: Yes. CVE-2024-22195 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0365.
When was CVE-2024-22195 published?: CVE-2024-22195 was published on 2024-01-11 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*

More vulnerabilities in Palletsprojects Jinja

CVE-2025-27516 — High (CVSS 8.8): Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts…
CVE-2024-56201 — High (CVSS 8.8): Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler…
CVE-2016-10745 — High (CVSS 8.6): In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
CVE-2019-10906 — High (CVSS 8.6): In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
CVE-2024-56326 — High (CVSS 7.8): Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects…
CVE-2024-34064 — Medium (CVSS 5.4): Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing…

All CVEs affecting Palletsprojects Jinja →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →