~ / search / GHSA-7xr5-9hcq-chf9

GHSA-7xr5-9hcq-chf9

Django Improper Output Neutralization for Logs vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-48432

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 5.2, < 5.2.2 5.2.2
PyPI Django >= 5.0a1, < 5.1.10 5.1.10
PyPI Django < 4.2.22 4.2.22

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

References

External links from the advisory. They lead to third-party sites.