This might be a false positive, but asap-tools/experiments/requirements.txt around line 3 looked worth a second pair of eyes.
CVE‑2024‑56201 in Jinja2 <3.1.5 lets an attacker who controls both the template filename and its contents break out of Jinja's sandbox and execute arbitrary Python code. When an application processes untrusted templates where the template author can also set the filename (e.g., uploaded templates with chosen names), this can lead to remote code execution. The risk is medium‑high because exploitation requires both content and filename control, but when those conditions are met the impact is severe.
Something like this might fix it:
--- a/asap-tools/experiments/requirements.txt
+++ b/asap-tools/experiments/requirements.txt
@@ -3 +3 @@
-Jinja2==3.1.2
+Jinja2==3.1.5
For reference: rule CVE-2024-56201. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
asap-tools/experiments/requirements.txtaround line 3 looked worth a second pair of eyes.CVE‑2024‑56201 in Jinja2 <3.1.5 lets an attacker who controls both the template filename and its contents break out of Jinja's sandbox and execute arbitrary Python code. When an application processes untrusted templates where the template author can also set the filename (e.g., uploaded templates with chosen names), this can lead to remote code execution. The risk is medium‑high because exploitation requires both content and filename control, but when those conditions are met the impact is severe.
Something like this might fix it:
For reference: rule
CVE-2024-56201. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.