Pallets · Jinja2 · CVE-2019-8341
**Name of the Vulnerable Software and Affected Versions**
Jinja2 version 2.10
**Description**
An issue was discovered in the from string function of Jinja2, which is prone to Server Side Template Injection (SSTI). The function takes the `source` parameter as a template object, renders it, and then returns it. An attacker can exploit this issue by using {{INJECTION COMMANDS}} in a URI. It is noted that the maintainer and multiple third parties believe this vulnerability is not valid because users should not use untrusted templates without sandboxing.
**Recommendations**
For Jinja2 version 2.10, as a temporary workaround, consider disabling the `from string` function until a patch is available or ensure that all templates used with this function are trusted and sandboxed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.