Skip to content
Heist/ feed
CriticalFix available

python-templated-dictionary security update

Type: advisorySource: OSV1 source record

Dictionary where __getitem__() is run through Jinja2 template. Security Fix(es): The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.(CVE-2023-6395)

Announced Group revision 1
Original source ↗

OESA-2026-4061

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4061

python-templated-dictionary

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.2-2.oe2403sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.2-2.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "python-templated-dictionary",
      "purl": "pkg:rpm/openEuler/python-templated-dictionary&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4061.json"
    },
    "ecosystem_specific": {
      "src": [
        "python-templated-dictionary-1.2-2.oe2403sp4.src.rpm"
      ],
      "noarch": [
        "python-templated-dictionary-help-1.2-2.oe2403sp4.noarch.rpm",
        "python3-templated-dictionary-1.2-2.oe2403sp4.noarch.rpm"
      ]
    }
  }
]

Publisher severity

critical

Source reference: /database_specific/severity

Event
#14723 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement