cve/2019/CVE-2019-10906.md

CVE-2019-10906

Description

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

POC

Reference

• https://usn.ubuntu.com/4011-1/

Github

• https://github.com/40docs/lab_forticnapp_code_security
• https://github.com/eltyagi/poc-codeql-artifact-attestation
• https://github.com/qyl2021/simiki
• https://github.com/tankywoo/simiki