Threats tagged 'ghsa-h5c8-rqwp-cp95'

Jinja2 versions prior to 3.1.3 have a vulnerability in the xmlattr filter that allows HTML attribute injection when user input is passed as keys. This occurs because keys containing spaces are accepted, which can be interpreted as multiple attributes, enabling potential cross-site scripting (XSS) if untrusted keys are rendered. This issue is mitigated by verifying keys or upgrading to version 3.1.3 or later.