From 64f68f874c8ef65e18b3f1af6747bb203dc0ae53 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 23 Dec 2024 17:56:30 +0000
Subject: [PATCH] Publish GHSA-gmj6-6f8f-6699

---
 .../GHSA-gmj6-6f8f-6699.json                  | 64 +++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/12/GHSA-gmj6-6f8f-6699/GHSA-gmj6-6f8f-6699.json

diff --git a/advisories/github-reviewed/2024/12/GHSA-gmj6-6f8f-6699/GHSA-gmj6-6f8f-6699.json b/advisories/github-reviewed/2024/12/GHSA-gmj6-6f8f-6699/GHSA-gmj6-6f8f-6699.json
new file mode 100644
index 00000000000..fecfe9c7091
--- /dev/null
+++ b/advisories/github-reviewed/2024/12/GHSA-gmj6-6f8f-6699/GHSA-gmj6-6f8f-6699.json
@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gmj6-6f8f-6699",
+  "modified": "2024-12-23T17:54:12Z",
+  "published": "2024-12-23T17:54:12Z",
+  "aliases": [
+    "CVE-2024-56201"
+  ],
+  "summary": "Jinja has a sandbox breakout through malicious filenames",
+  "details": "A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.\n\nTo exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "jinja2"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.5"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.1.4"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pallets/jinja"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-150"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-23T17:54:12Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file