Jinja2 (py3-jinja2) CVE-2025-27516 GHSA-CPWX-VRP4-4PQ7

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:13 vuln.today

DescriptionCVE.org

Alpine Linux: py3-jinja2 fixed in 3.1.6-r0

AnalysisAI

Jinja2 Python templating library, packaged as py3-jinja2 in Alpine Linux, contains a vulnerability addressed in version 3.1.6. The Alpine Linux vendor advisory confirms a fix was released as package version 3.1.6-r0, indicating a security-relevant defect in prior versions of the library. The nature of the vulnerability - whether sandbox escape, template injection, or another class - is not confirmed from the provided data alone; the GHSA identifier GHSA-CPWX-VRP4-4PQ7 points to a GitHub Security Advisory that may contain fuller details. No public exploit or CISA KEV listing is present in the provided intelligence.

Technical ContextAI

Jinja2 is a widely-used Python templating engine that provides a sandboxed execution environment for template rendering. The py3-jinja2 package on Alpine Linux bundles this upstream library. The GHSA identifier GHSA-CPWX-VRP4-4PQ7 corresponds to a GitHub Security Advisory for the Jinja2 project; upstream fix version 3.1.6 is implied by the Alpine package fix at 3.1.6-r0. No CWE classification was provided in the input data, so the root cause class (e.g., sandbox bypass, code injection, path traversal) cannot be confirmed from the available intelligence. No CPE strings were supplied, precluding formal affected-product scoping from this dataset.

Affected ProductsAI

Alpine Linux packages py3-jinja2 versions prior to 3.1.6-r0 are confirmed affected per the Alpine vendor advisory. The upstream Jinja2 Python library version corresponding to Alpine package 3.1.6-r0 is inferred to be Jinja2 3.1.6 upstream, meaning Jinja2 releases earlier than 3.1.6 are likely affected; however, this upstream version mapping is inferred, not independently confirmed from the provided data. No CPE strings were supplied, and no vendor advisory URL was included in the references.

RemediationAI

Upgrade py3-jinja2 on Alpine Linux to version 3.1.6-r0 or later using the standard Alpine package manager: 'apk upgrade py3-jinja2'. For non-Alpine environments using pip, upgrade to Jinja2 3.1.6 or later via 'pip install --upgrade Jinja2', as this is the upstream fix version inferred from the Alpine package version. No vendor advisory URL was provided in the input data; consult the GitHub Security Advisory at GHSA-CPWX-VRP4-4PQ7 directly for full remediation guidance. No workarounds or compensating controls are identifiable from the available data given the absence of CWE and CVSS vector information.