CVE-2019-10906

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox. This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods. If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

En Pallets Jinja, en versiones anteriores a la 2.10.1, str.format_map permite un escape de sandbox.