The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 3, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-domain_nameUpgrade rubygem-unicodeUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-jwtUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-localeUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cliUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-display_widthUpgrade rubygem-gssapiUpgrade rubygem-netrcUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debugsourceUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-unf_extUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-multi_jsonUpgrade rubygem-rest-clientUpgrade rubygem-unfUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-apipie-bindingsUpgrade rubygem-loggingUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade foreman-cliUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade tfm-rubygem-unfUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffiUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-domain_nameUpgrade python39-pulp_manifestUpgrade tfm-runtimeUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-netrcUpgrade rubygem-localeUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-amazing_printUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-oauthUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_bootdisk | Jul 14, 2022 | Feb 3, 2022 |
| Debian | — | Upgrade python-django | Feb 3, 2022 | Feb 3, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-http-cookieUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade rubygem-loggingUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-runtimeUpgrade rubygem-jwtUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unf_extUpgrade satellite-cliUpgrade tfm-rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-clampUpgrade tfm-rubygem-jwtUpgrade rubygem-gssapiUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-powerbarUpgrade tfm-rubygem-http-cookieUpgrade rubygem-amazing_printUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-oauthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-netrcUpgrade foreman-cliUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-loggingUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unicode | Jul 14, 2022 | Feb 3, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 12, 2024 | Feb 3, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Feb 3, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django (Ubuntu Pro)Upgrade python-django (Ubuntu Pro)Upgrade python3-django | Feb 4, 2022 | Feb 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub