CVE-2024-34064

MediumCVSS 5.4

Published: 06/05/2024(UTC)Updated: 17/06/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Summary

The xmlattr filter in Jinja accepts keys containing characters not allowed in XML/HTML attributes, such as spaces, /, >, or =. If an application accepts keys from user input and renders them on pages seen by other users, an attacker could inject additional attributes and perform XSS.

Risk Assessment

This can lead to cross-site scripting (XSS) in applications using the xmlattr filter with user-supplied keys.

Recommendation

Update Jinja to version 3.1.4 or later and avoid passing user-supplied keys to the xmlattr filter.

Other vulnerabilities in Jinja

CVE-2024-22195Medium
Jinja is an extensible templating engine. It is possible to inject arbitrary HTML attributes into the rendered HTML template via the xmlattr filter, bypassing the auto-escaping mechanism and potentially leading to Cross-Site Scripting (XSS). It may also be possible to bypass blacklist-based attribute validation.

Original NVD description (English source)

Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS