CVE-2019-8341Jinja2 Command Injection
The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it.
Published Feb 15, 2019 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2019-8341, UBUNTU-CVE-2019-8341
Key Facts
Patch immediately- CVE-2019-8341 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Jinja2 (Pocoo), Leap (Opensuse), ardana-cassandra (suse) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 44% probability of exploitation in the next 30 days.
- Fixed versions are available, including ardana-cassandra 9.0+git.1600802664.7e480a2-3.6.2, ardana-mq 9.0+git.1605174486.a78ddce-3.19.2, ardana-osconfig 9.0+git.1601621747.a87e5a0-3.22.2.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
44%
Higher than 98.7% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
51/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing
Affected Products
404 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Jinja2Pocoo | 2.10 | 1 |
| LeapOpensuse | 15.0, 42.3 | n/a |
| ardana-cassandrasuse | See advisory | 9.0+git.1600802664.7e480a2-3.6.2 |
| ardana-mqsuse | See advisory | 9.0+git.1605174486.a78ddce-3.19.2 |
| ardana-osconfigsuse | See advisory | 9.0+git.1601621747.a87e5a0-3.22.2 |
Patched Releases
ardana-cassandra
9.0+git.1600802664.7e480a2-3.6.2
ardana-mq
9.0+git.1605174486.a78ddce-3.19.2
ardana-osconfig
9.0+git.1601621747.a87e5a0-3.22.2
ardana-tempest
9.0+git.1603378983.fc0bca9-3.19.2
crowbar-core
5.0+git.1606840757.839a64745-3.47.1, 6.0+git.1606314264.bf9ada813-3.31.2
crowbar-core-branding-upstream
5.0+git.1606840757.839a64745-3.47.1, 6.0+git.1606314264.bf9ada813-3.31.2
crowbar-openstack
5.0+git.1604938523.ded915845-4.46.1, 6.0+git.1604573541.bb18c172d-3.28.3
grafana
6.7.4-3.20.1, 6.7.4-4.15.1
influxdb
1.3.4-4.3.1, 1.3.8-4.3.3
Jinja2
1
openstack-cinder
13.0.10~dev20-3.28.2
openstack-cinder-api
13.0.10~dev20-3.28.2
openstack-cinder-backup
13.0.10~dev20-3.28.2
openstack-cinder-scheduler
13.0.10~dev20-3.28.2
openstack-cinder-volume
13.0.10~dev20-3.28.2
openstack-heat
11.0.4~dev4-3.19.2
openstack-heat-api
11.0.4~dev4-3.19.2
openstack-heat-api-cfn
11.0.4~dev4-3.19.2
openstack-heat-engine
11.0.4~dev4-3.19.2
openstack-heat-gbp
12.0.1~dev2-3.3.4
openstack-heat-plugin-heat_docker
11.0.4~dev4-3.19.2
openstack-heat-templates
0.0.0+git.1605509190.64f020b-3.18.1, 0.0.0+git.1605509190.64f020b6-3.9.3
openstack-horizon-plugin-gbp-ui
12.0.1~dev3-3.3.4
openstack-ironic-python-agent
3.3.4~dev6-3.19.4
openstack-manila
7.4.2~dev57-4.30.2
Timeline
Publicly disclosed
Feb 15, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisorysecurity-tracker.debian.org · CVE-2019-8341
- advisoryubuntu.com · CVE-2019-8341
- advisorycve.org · CVERecord
- advisoryopenSUSE-SU-2019:1395
- advisoryopenSUSE-SU-2019:1614
FAQ
Common Questions.
An issue was discovered in Jinja2 2.10.
Affected: Jinja2 (Pocoo) versions 2.10; Leap (Opensuse) versions 15.0, 42.3; ardana-cassandra (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ardana-cassandra 9.0+git.1600802664.7e480a2-3.6.2, ardana-mq 9.0+git.1605174486.a78ddce-3.19.2, ardana-osconfig 9.0+git.1601621747.a87e5a0-3.22.2.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2019-8341 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo