elapouya / python-docx-template

Use a docx as a jinja2 template
GNU Lesser General Public License v2.1
1.92k stars 378 forks source link

Jinja2 vulnerability patch request #526

Open dralexxx opened 4 months ago

dralexxx commented 4 months ago

Is your feature request related to a problem? Please describe.

Jinja2 3.1.2 has a medium-level vulnerability which allows for a cross-site scripting attack to occur. Source: https://security.snyk.io/package/pip/Jinja2/3.1.2 Source: https://dev.to/snyk/understanding-and-mitigating-the-jinja2-xss-vulnerability-cve-2024-22195-1f2m

This should be patched at source, as it will be picked up and highlighted in software vulnerability scanning software.

Describe the solution you'd like

Update Jinja2 pipfile dependency version from 3.1.2 to version 3.1.3 to mitigate the issue.

Describe alternatives you've considered

N/A

Additional context

N/A