CVE-2024-56326 is a high-severity vulnerability in Jinja2 versions prior to 3.1.5 that allows sandbox breakout via indirect calls to the str.format method. An attacker who can control template content in applications executing untrusted templates may exploit this to execute arbitrary Python code. The vulnerability arises because the sandbox does not detect indirect references to str.format, which can be invoked through custom filters. This issue is fixed in Jinja2 version 3.1.5.