Skip to main content
CVE-2024-34064VulnerabilityPublished Updated

SUSE · security update for python-jinja2

Affects SUSESource GCVE Database

0

Mentioned vulnerabilities

Authoritative record:CVE-2024-34064· Medium 5.4

Not known to be exploited · CVSS 5.4 Medium : upgrade to 2.27.0 when convenient.

Data as of 26 Oct 2026, 06:26 UTC

CVSS base score
5.4Medium
How severe the flaw is on the 0–10 CVSS scale.
EPSS
0.9% chance of exploitation in 30 days – higher than 61% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 2.27.0

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 6 May 2024

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

What to do

Upgrade locust to 2.27.0.

Affected software

ProductAffectedFixed in
Homebrewlocustpkg:brew/locustOther threatsAffected
  • >=2.2.1 <2.27.0
Fixed in
  • 2.27.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released updated fence-agents packages that address CVE-2024-34064. Users of affected Red Hat Enterprise Linux 8.4 and 8.8 variants should apply the security updates as detailed in Red Hat advisories RHSA-2024:3811 and RHSA-2024:3795. Instructions for applying these updates are available at https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigation steps are indicated by the vendor.

Description

The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.

References

Community reviews

Loading reviews…