CVE-2019-10906

Name of the Vulnerable Software and Affected Versions Pallets Jinja versions prior to 2.10.1

Description The issue allows a sandbox escape through the str.format map method. This method could be used to bypass the sandbox, which is designed to restrict the evaluation of untrusted, user-provided templates. The problem arises due to the way string formatting works in Python.

Recommendations For versions prior to 2.10.1, update to version 2.10.1 or later to resolve the issue. As a temporary workaround, consider overriding the is safe attribute method on the sandbox and explicitly disallow the format map method on string objects.