-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability description explicitly names django.util.http.is_safe_url as the source of improper input handling. The GitHub patch shows a code change adding 'url = url.strip()' to address leading whitespace. Test cases in the commit diff demonstrate validation of URLs with newline characters, confirming the attack vector. Multiple advisories (CVE-2015-0220, GHSA-gv98-g628-m9x5) and Django's own security bulletin directly reference this function as the vulnerability point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django | pip | < 1.4.18 | 1.4.18 |
| Django | pip | >= 1.6, < 1.6.10 | 1.6.10 |
| Django | pip | >= 1.7, < 1.7.3 | 1.7.3 |
Ongoing coverage of React2Shell