CVE-2024-34064: 
Python vulnerability analysis and mitigation

CVE-2024-34064 affects Jinja, an extensible templating engine, in versions prior to 3.1.4. The vulnerability exists in the xmlattr filter which accepts keys containing non-attribute characters. The issue was discovered in May 2024 and was assigned a CVSS v3.1 base score of 5.4 (Moderate) (GitHub Advisory).

The vulnerability stems from the xmlattr filter accepting keys containing characters that are invalid in XML/HTML attributes, specifically spaces, / (solidus), > (greater-than sign), or = (equals sign). These characters would be interpreted as starting separate attributes in XML/HTML context. This is a continuation of the fix for CVE-2024-22195, which only addressed spaces but not other characters (GitHub Advisory).

If an application accepts keys (as opposed to only values) as user input and renders these in pages that other users can view, an attacker could exploit this vulnerability to inject additional HTML attributes and perform Cross-Site Scripting (XSS) attacks (GitHub Advisory).

The vulnerability requires user interaction and network access. An attacker needs no privileges to exploit this vulnerability, though the attack complexity is considered low. The vulnerability has been assigned CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability is fixed in Jinja version 3.1.4. Users should upgrade to this version. Additionally, it is now explicitly considered an unintended use case to accept keys as user input for the xmlattr filter. Applications should either avoid using user input as keys or implement separate validation before using such input. Note that accepting values (as opposed to keys) as user input continues to be safe (GitHub Advisory).