The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 3, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unfUpgrade tfm-runtimeUpgrade rubygem-amazing_printUpgrade foreman-cliUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-highlineUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-localeUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade python39-pulp_manifestUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-unicodeUpgrade rubygem-unf_extUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-mime-typesUpgrade rubygem-foreman_maintainUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-cliUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-mime-typesUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-domain_nameUpgrade rubygem-ffiUpgrade rubygem-hammer_cliUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-domain_nameUpgrade satellite-cloneUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-rest-clientUpgrade rubygem-unfUpgrade tfm-rubygem-loggingUpgrade rubygem-netrcUpgrade tfm-rubygem-rest-clientUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-unicodeUpgrade rubygem-gssapiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-jwtUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-fast_gettextUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-jwtUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman | Jul 14, 2022 | Feb 3, 2022 |
| Debian | — | Upgrade python-django | Feb 3, 2022 | Feb 3, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade satellite-cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-ffi-debugsourceUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-localeUpgrade rubygem-ffiUpgrade rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-jwtUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-runtimeUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debuginfoUpgrade tfm-rubygem-highlineUpgrade rubygem-unf_extUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-domain_nameUpgrade rubygem-little-pluggerUpgrade rubygem-loggingUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-netrcUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-rest-clientUpgrade rubygem-oauthUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-gssapiUpgrade rubygem-domain_nameUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-highlineUpgrade satellite-cloneUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-netrc | Jul 14, 2022 | Feb 3, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Feb 3, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Feb 3, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django (Ubuntu Pro)Upgrade python3-djangoUpgrade python-django (Ubuntu Pro) | Feb 4, 2022 | Feb 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub