-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 1.3.0, < 1.3.6 | 1.3.6 |
| Django | pip | >= 1.4.0, < 1.4.4 | 1.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Django's XML deserialization using Python's vulnerable xml.dom.pulldom.parse() with default settings. The commit diffs show the patch introduced DefusedExpatParser to disable DTDs and external entities. Prior to this, the lack of restrictions in the XML parser allowed XXE attacks. The core vulnerable functions are the deserializer initialization and underlying Expat-based parsing mechanism.
PythonPythonOngoing coverage of React2Shell