Brian Welch

**Name of the Vulnerable Software and Affected Versions** Pallets Jinja versions prior to 2.10.1 **Description** The issue allows a sandbox escape through the `str.format map` method. This method could be used to bypass the sandbox, which is designed to restrict the evaluation of untrusted, user-provided templates. The problem arises due to the way string formatting works in Python. **Recommendations** For versions prior to 2.10.1, update to version 2.10.1 or later to resolve the issue. As a temporary workaround, consider overriding the `is safe attribute` method on the sandbox and explicitly disallow the `format map` method on string objects.