{
  "cvss": 5.4,
  "datePublished": "2024-05-06T14:00:00Z",
  "dateUpdated": "2024-05-10T18:00:00Z",
  "description": "Jinja2 prior to 3.1.4 accepts keys containing non-attribute characters in xmlattr filter allowing injection of arbitrary HTML attributes.",
  "id": "PYSEC-2024-26",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "version": "3.1"
        }
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "pysec",
  "title": "PySec: Jinja2 HTML attribute injection"
}