Threats tagged 'ghsa-h75v-3vvj-5mfj'

Jinja2 versions prior to 3.1.4 have a vulnerability in the xmlattr filter where user input passed as keys can include characters that lead to HTML attribute injection. This can allow an attacker to inject additional attributes and potentially perform cross-site scripting (XSS) if the application renders these keys in pages viewed by other users. The issue arises because xmlattr does not restrict keys from containing characters like spaces, '/', '>', or '=', which are invalid in XML/HTML attributes. The vulnerability is fixed in version 3.1.4.