Prevent setting arbitrary attrs on Jinja2 envs via overrides (#80715)

2 files changed, 6 insertions, 1 deletions

diff --git a/changelogs/fragments/no-arbitrary-j2-override.yml b/changelogs/fragments/no-arbitrary-j2-override.yml
new file mode 100644
index 0000000000..c2fcf1c565
--- /dev/null
+++ b/changelogs/fragments/no-arbitrary-j2-override.yml
@@ -0,0 +1,2 @@
+bugfixes:
+  - templating - prevent setting arbitrary attributes on Jinja2 environments via Jinja2 overrides in templates
diff --git a/lib/ansible/template/__init__.py b/lib/ansible/template/__init__.py
index f08cfcebb7..f389b16939 100644
--- a/lib/ansible/template/__init__.py
+++ b/lib/ansible/template/__init__.py
@@ -932,7 +932,10 @@ class Templar:
                                            " Did you use something different from colon as key-value separator?" % pair.strip())
                     (key, val) = pair.split(':', 1)
                     key = key.strip()
-                    setattr(myenv, key, ast.literal_eval(val.strip()))
+                    if hasattr(myenv, key):
+                        setattr(myenv, key, ast.literal_eval(val.strip()))
+                    else:
+                        display.warning(f"Could not find Jinja2 environment setting to override: '{key}'")
 
             if escape_backslashes:
                 # Allow users to specify backslashes in playbooks as "\\" instead of as "\\\\".