CVE: 0000-0000 found in Jinja2 - Version: 2.11.3 [PYTHON]

[github-actions]

Veracode Software Composition Analysis

Attribute	Details
Library	Jinja2
Description	A very fast and expressive template engine.
Language	PYTHON
Vulnerability	Cross-Site Scripting (XSS)
Vulnerability description	jinja2 is vulnerable to Cross Site Scripting. An attacker is able to inject and execute arbitrary Javascript through the gettext and ngettext function due to the lack of output sanitization.
CVE	null
CVSS score	5.8
Vulnerability present in version/s	2.5-3.0.0
Found library version/s	2.11.3
Vulnerability fixed in version
Library latest version	3.1.2
Fix	There is no fix version. Apply the following fix:

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/167488?version=2.11.3
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/27903
• Patch:

[mdesmet]

Jinja will be upgraded to 3.0 version in dbt1.3

See dbt-labs/dbt-core#4748