-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key factors:
base.html template explicitly disabled autoescaping via {% autoescape off %} around the response rendering logic, which removed Django's default XSS protections.urlize_quoted_links filter's pre-patch implementation did not properly enforce escaping in autoescape-disabled contexts. It relied on manual escaping checks (safe_input and autoescape flags) but failed to ensure all user-controlled content was sanitized when autoescape was globally disabled in the template.The combination of these two factors allowed untrusted input (e.g., content or response_headers values) to render without escaping. The commit diff shows the removal of {% autoescape off %} in base.html and fixes to urlize_quoted_links to use a unified conditional_escape helper, ensuring proper escaping regardless of the autoescape context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-rest-framework | pip | < 3.9.1 | 3.9.1 |
Ongoing coverage of React2Shell