jinja2 3.1.6

Source: https://github.com/pallets/jinja
Artifact scanned: jinja2-3.1.6-py3-none-any.whl (wheel · 131.7 KB · SHA-256 85ece4451f49…)
Compared with: jinja2-3.1.5-py3-none-any.whl (0 signals introduced since)
Files: 27 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 11 info
Scan time: 9.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 9 of 9 warn and critical signals; 9 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 01:03

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info unicode-mixed-script jinja2/_identifier.py:5:27

identifier `ׇֽֿׁׂׅׄؐ` mixes scripts: Hebrew + Arabic (in string/comment) (raw pass, confidence 0.40)

    r"[\w·̀-ͯ·҃-֑҇-ׇֽֿׁׂׅׄؐ-ًؚ-ٰٟۖ-ۜ۟-۪ۤۧۨ-ܑۭܰ-݊ަ-ް߫-߽߳ࠖ-࠙ࠛ-ࠣࠥ-ࠧࠩ-࡙࠭-࡛࣓-ࣣ࣡-ःऺ-़ा-ॏ॑-ॗॢॣঁ-ঃ়া-ৄেৈো-্ৗৢৣ৾ਁ-ਃ਼ਾ-ੂੇੈੋ-੍ੑੰੱੵઁ-ઃ઼ા-ૅે-ૉો-્ૢૣૺ-૿ଁ-ଃ଼ା-ୄେୈୋ

info unicode-mixed-script jinja2/_identifier.py:5:70

identifier `ܑۭܰ` mixes scripts: Arabic + Other (in string/comment) (raw pass, confidence 0.40)

�ׇׁׂׅׄؐ-ًؚ-ٰٟۖ-ۜ۟-۪ۤۧۨ-ܑۭܰ-݊ަ-ް߫-߽߳ࠖ-࠙ࠛ-ࠣࠥ-ࠧࠩ-࡙࠭-࡛࣓-ࣣ࣡-ःऺ-़ा-ॏ॑-ॗॢॣঁ-ঃ়া-ৄেৈো-্ৗৢৣ৾ਁ-ਃ਼ਾ-ੂੇੈੋ-੍ੑੰੱੵઁ-ઃ઼ા-ૅે-ૉો-્ૢૣૺ-૿ଁ-ଃ଼ା-ୄେୈୋ-୍ୖୗୢୣஂா-ூ… (340 bytes total)

info ~~critical~~ → info by review unicode-invisible jinja2/_identifier.py:5:1101

4 invisible tag characters on this line (possible encoded payload) (raw pass, confidence 0.99)
```
��ꪾ꪿꫁ꫫ-ꫯꫵ꫶ꯣ-ꯪ꯬꯭ﬞ⟨U+FE00⟩-⟨U+FE0F⟩︠-︯︳︴﹍-﹏＿𐇽𐋠𐍶-𐍺𐨁-𐨃𐨅𐨆𐨌-𐨏𐨸-𐨿𐨺𐫦𐫥𐴤-𐽆𐴧-𐽐𑀀-𑀂𑀸-𑁆𑁿-𑂂𑂰-𑂺𑄀-𑄂𑄧-𑄴𑅅𑅆𑅳𑆀-𑆂𑆳-𑇀𑇉-𑇌𑈬-𑈷𑈾𑋟-𑋪𑌀-𑌃𑌻𑌼𑌾-𑍄𑍇𑍈𑍋-𑍍𑍗… (339 bytes total)
```
likely benign LLM, confidence 0.85 A generated Unicode identifier-character table in Jinja2's identifier module.
Reasoning
The line is a long character class of Unicode identifier-continuation ranges, which Jinja2 uses to match valid Python identifiers. The invisible tag and format characters are part of the Unicode ID_Continue tables, not a hidden payload. The raw pass has a high false-positive rate, and nothing here decodes or executes anything.
info ~~warn~~ → info by review dynamic-execution jinja2/bccache.py:79:25

`marshal.load` deserializes Python bytecode from bytes — code-object sink (ast pass, confidence 0.75)
```
        try:
            self.code = marshal.load(f)
        except (EOFError, ValueError, TypeError):
            self.reset()
```
likely benign LLM, confidence 0.80 Loads cached compiled template bytecode from the bytecode cache.
Reasoning
marshal.load reads Jinja2's own bytecode cache files written by the same library. Unmarshalling untrusted cache data is a known risk, but this is the standard, expected use in a legitimate template cache, and the surrounding code only resets on read errors.
info ~~critical~~ → info by review dynamic-execution jinja2/debug.py:105:22

`compile` called on a constructed string (ast pass, confidence 0.80)
```
    # Raise an exception at the correct line number.
    code: CodeType = compile(
        "\n" * (lineno - 1) + "raise __jinja_exception__", filename, "exec"
    )
```
likely benign LLM, confidence 0.90 Compiles a stub that raises an exception at a chosen line for traceback rewriting.
Reasoning
This builds a padded source string so that a raised exception reports the right line number in a rewritten traceback. The string is internal and contains no external input, which is a standard debugging technique.
info ~~warn~~ → info by review dynamic-execution jinja2/debug.py:145:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    try:
        exec(code, globals, locals)
    except BaseException:
        return sys.exc_info()[2].tb_next  # type: ignore
```
likely benign LLM, confidence 0.85 Executes generated template code while capturing a traceback.
Reasoning
Executes compiled template code in the debug traceback machinery so that the original error can be reproduced and its traceback captured. The code comes from the template compiler, so this is the expected behaviour of Jinja2's debugger.
info ~~warn~~ → info by review dynamic-execution jinja2/environment.py:709:16

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        """
        return compile(source, filename, "exec")

    @typing.overload
```
likely benign LLM, confidence 0.90 Compiles generated template source into a Python code object.
Reasoning
This is Environment.compile, which turns template source into a code object. Compiling template source is the core function of a template engine. The source comes from template files the application chooses to load.
info ~~warn~~ → info by review dynamic-execution jinja2/environment.py:1228:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        namespace = {"environment": environment, "__file__": code.co_filename}
        exec(code, namespace)
        rv = cls._from_namespace(environment, namespace, globals)
        rv._uptodate = uptodate
```
likely benign LLM, confidence 0.85 Executes precompiled template code to build a Template object.
Reasoning
This is the from_code/from_module_dict path that executes precompiled template code in a namespace. It is the documented mechanism for loading precompiled templates, and the code comes from the template compiler, not from an untrusted network source in this snippet.
info ~~critical~~ → info by review dynamic-import jinja2/loaders.py:680:23

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            try:
                mod = __import__(module, None, None, ["root"])
            except ImportError as e:
                raise TemplateNotFound(name) from e
```
likely benign LLM, confidence 0.85 Imports a configured module to load its precompiled templates.
Reasoning
ModuleLoader imports a configured package module by name in order to load precompiled templates from it. The module name comes from the application's loader configuration, not from template content, which is the expected pattern for this loader.
info ~~critical~~ → info by review dynamic-import jinja2/utils.py:157:20

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            return __import__(import_name)
        return getattr(__import__(module, None, None, [obj]), obj)
    except (ImportError, AttributeError):
```
likely benign LLM, confidence 0.90 Dynamically imports a module or attribute from a dotted import name.
Reasoning
This is the import_string helper, which resolves a dotted name to an object. Dynamic import is its purpose, and the name is supplied by the calling application, as is standard in this utility.
info ~~critical~~ → info by review dynamic-import jinja2/utils.py:158:24

`__import__` called on a non-literal expression (ast pass, confidence 0.70)
```
            return __import__(import_name)
        return getattr(__import__(module, None, None, [obj]), obj)
    except (ImportError, AttributeError):
        if not silent:
```
likely benign LLM, confidence 0.90 Resolves an attribute from a dynamically imported module in import_string.
Reasoning
This is the same import_string helper, with the getattr fallback for resolving an attribute. It is ordinary library behaviour, and the import path is a caller-provided configuration value.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o jinja2-3.1.6-py3-none-any.whl https://files.pythonhosted.org/packages/62/a1/3d680cbfd5f4b8f15abc1d571870c5fc3e594bb582bc3b64ea099db13e56/jinja2-3.1.6-py3-none-any.whl
printf '%s  %s\n' 85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67 jinja2-3.1.6-py3-none-any.whl | shasum -a 256 -c -
unzip -q jinja2-3.1.6-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg