-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the AdminURLFieldWidget's render method in widgets.py. The pre-patch code explicitly marked the URL value as safe (mark_safe(smart_urlquote(value))) when building the <a> tag's href attribute. Since smart_urlquote only performs URL encoding, not HTML escaping, this allowed XSS via 'javascript:' URLs or HTML-containing URL paths. The commit removed mark_safe() and let Django's template autoescaping handle the value properly. The accompanying test cases demonstrate XSS scenarios being fixed through proper escaping.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django | pip | >= 1.5, < 1.5.2 | 1.5.2 |
Ongoing coverage of React2Shell