The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Feb 3, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Feb 3, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-little-pluggerUpgrade satellite-maintainUpgrade tfm-rubygem-unf_extUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-loggingUpgrade satellite-cloneUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-multi_jsonUpgrade rubygem-ffi-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-netrcUpgrade tfm-rubygem-rest-clientUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-localeUpgrade rubygem-gssapiUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unfUpgrade satellite-cliUpgrade rubygem-loggingUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-http-cookieUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade tfm-runtimeUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade python39-pulp_manifestUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-amazing_printUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-oauthUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-clampUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-unf_extUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-highlineUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configure | Jul 14, 2022 | Feb 3, 2022 |
| Debian | — | Upgrade python-django | Feb 3, 2022 | Feb 3, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-unfUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-jwtUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-hashieUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-amazing_printUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-powerbarUpgrade tfm-rubygem-rest-clientUpgrade rubygem-foreman_maintainUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-highlineUpgrade rubygem-rest-clientUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cliUpgrade rubygem-oauthUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-clampUpgrade tfm-rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-ffiUpgrade python39-pulp_manifestUpgrade rubygem-unf_extUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade tfm-rubygem-domain_nameUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-ffi-debuginfoUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-jwtUpgrade satellite-cliUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hashieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debugsourceUpgrade tfm-runtimeUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_webhooks | Jul 14, 2022 | Feb 3, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Feb 3, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Feb 3, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django (Ubuntu Pro)Upgrade python3-django (Ubuntu Pro)Upgrade python-django | Feb 4, 2022 | Feb 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub