# Flask: Jinja 2.10.1 Security Release

**URL:** <https://forum.devtalk.com/t/flask-jinja-2-10-1-security-release/2196>\
**Category:** Backend Official News\
**Tags:** framework-blog-posts, flask\
**Created:** [15 September 2020 03:47 UTC](https://forum.devtalk.com/t/flask-jinja-2-10-1-security-release/2196 "2020-09-15T03:47:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![bot](https://forum.devtalk.com/user_avatar/forum.devtalk.com/bot/32/1112_2.png) [@bot](https://forum.devtalk.com/u/bot)\
**Post date:** [15 September 2020 03:47 UTC](https://forum.devtalk.com/t/flask-jinja-2-10-1-security-release/2196/1 "2020-09-15T03:47:00Z")

</div>

A new Flask blog post/annoucement has been posted!

> [@](#):
>
> Jinja 2.10.1 has been released and includes a security-related fix. If you are using the Jinja [sandboxed environment](http://jinja.pocoo.org/docs/2.10/sandbox/) you are encouraged to upgrade.
> 
> MITRE has assigned [CVE-2019-10906](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10906) to this issue.
> 
> Thank you to [Brian Welch](https://brianwel.ch) for responsibly reporting the issue, and to [Armin Ronacher](https://twitter.com/mitsuhiko) for writing the fix.
> 
> The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.
> 
> This issue was previously addressed for the `str.format` method in [Jinja 2.8.1](https://forum.devtalk.com/blog/jinja-281-released/), which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.
> 
> If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
> 
> ## Reporting Security Issues
> 
> If you think you have discovered a security issue in Jinja or another of the Pallets projects, please email [security@palletsprojects.com](mailto:security@palletsprojects.com) with details.

Get the full details here: [Jinja 2.10.1 Security Release | The Pallets Projects](https://palletsprojects.com/blog/jinja-2-10-1-released/)