Description

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Related CPE's

a

django-rest-framework

django_rest_framework

Vulnerable

References

https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8

PatchThird Party Advisory

https://github.com/encode/django-rest-framework/pull/6191

Third Party Advisory

https://github.com/encode/django-rest-framework/pull/6330

Third Party Advisory

https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8

PatchThird Party Advisory

https://github.com/encode/django-rest-framework/pull/6191

Third Party Advisory

https://github.com/encode/django-rest-framework/pull/6330

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2022-07-23T02:15:07.267Z

4 years ago

Last modified

2026-06-17T01:54:35.713Z

2 months ago