GHSA-95rw-fx8r-36v6

Cross-site Scripting in Django

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-22818

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 2.2, < 2.2.27	2.2.27
PyPI	Django	>= 3.2, < 3.2.12	3.2.12
PyPI	Django	>= 4.0, < 4.0.2	4.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

The `{% debug %}` template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-22818 advisory
https://github.com/django/django/commit/01422046065d2b51f8f613409cad2c81b39487e5 web
https://github.com/django/django/commit/1a1e8278c46418bde24c86a65443b0674bae65e2 web
https://github.com/django/django/commit/c27a7eb9f40b64990398978152e62b6ff839c2e6 web
https://docs.djangoproject.com/en/4.0/releases/security web
https://github.com/advisories/GHSA-95rw-fx8r-36v6 advisory
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-19.yaml web
https://groups.google.com/forum/#!forum/django-announce web
https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV web
https://security.netapp.com/advisory/ntap-20220221-0003 web
https://www.debian.org/security/2022/dsa-5254 web
https://www.djangoproject.com/weblog/2022/feb/01/security-releases web