CVE-2020-28493

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Feb 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-284948.6This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used toCVE-2020-284957.3This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However tCVE-2020-284967.5This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function bCVE-2020-284986.8The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is noCVE-2020-284999.8All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .CVE-2020-28508.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-285005.3Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functionsCVE-2020-285017.5This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.CVE-2020-285028.1This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (CVE-2020-285039.8The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-28528.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that ar
CVE-2020-28493: Medium severity, CVSS 5.3 | Vulnix