diff --git a/.changes/unreleased/Security-20240222-152445.yaml b/.changes/unreleased/Security-20240222-152445.yaml
new file mode 100644
index 00000000000..5c92c452ab0
--- /dev/null
+++ b/.changes/unreleased/Security-20240222-152445.yaml
@@ -0,0 +1,6 @@
+kind: Security
+body: Update Jinja2 to >= 3.1.3 to address CVE-2024-22195
+time: 2024-02-22T15:24:45.158305-08:00
+custom:
+  Author: QMalcolm
+  PR: CVE-2024-22195
diff --git a/core/setup.py b/core/setup.py
index 3a575747f54..5d795fdc15c 100644
--- a/core/setup.py
+++ b/core/setup.py
@@ -50,7 +50,7 @@
         # dbt-core uses these packages deeply, throughout the codebase, and there have been breaking changes in past patch releases (even though these are major-version-one).
         # Pin to the patch or minor version, and bump in each new minor version of dbt-core.
         "agate~=1.7.0",
-        "Jinja2~=3.1.2",
+        "Jinja2>=3.1.3,<4",
         "mashumaro[msgpack]~=3.9",
         # ----
         # Legacy: This package has not been updated since 2019, and it is unused in dbt's logging system (since v1.0)