The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 3, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2022 |
| Centos_linux | — | Upgrade rubygem-foreman_maintainUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade rubygem-clampUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-amazing_printUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cliUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade tfm-rubygem-unfUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hashieUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unicodeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_extUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-localeUpgrade tfm-rubygem-netrcUpgrade python39-pulp_manifestUpgrade tfm-rubygem-highlineUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_openscapUpgrade foreman-cliUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cliUpgrade satellite-cloneUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade rubygem-netrcUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debugsourceUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-fast_gettextUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-display_widthUpgrade rubygem-jwtUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-clampUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-jwtUpgrade rubygem-unfUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_ansible | Jul 14, 2022 | Feb 3, 2022 |
| Debian | — | Upgrade python-django | Feb 3, 2022 | Feb 3, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-foreman_maintainUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-fast_gettextUpgrade foreman-cliUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-netrcUpgrade rubygem-unfUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-rest-clientUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-clampUpgrade rubygem-gssapiUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-cookieUpgrade rubygem-ffi-debuginfoUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-oauthUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-domain_nameUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-runtimeUpgrade rubygem-netrcUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-little-pluggerUpgrade satellite-cliUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade rubygem-unicodeUpgrade rubygem-localeUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_openscapUpgrade python39-pulp_manifestUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_ansible | Jul 14, 2022 | Feb 3, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Feb 3, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Feb 3, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python-django | Feb 4, 2022 | Feb 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub