python3-jinja2: Jinja is an extensible templating engine

Jinja is an extensible templating engine. Prior to 3.1.6, an oversight inhow the Jinja sandboxed environment interacts with the |attr filter allowsan attacker that controls the content of a template to execute arbitraryPython code. To exploit the vulnerability, an attacker needs to control thecontent of a template. Whether that is the case depends on the type ofapplication using Jinja. This vulnerability impacts users of applicationswhich execute untrusted templates. Jinja's sandbox does catch calls tostr.format and ensures they don't escape the sandbox. However, it'spossible to use the |attr filter to get a reference to a string's plainformat method, bypassing the sandbox. After the fix, the |attr filter nolonger bypasses the environment's attribute lookup. This vulnerability isfixed in 3.1.6.

Where it's fixed