chore(deps): update dependency django to v4 [security]

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
django (changelog)	==1.8.12 → ==4.2.26

---

Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

CVE-2018-7537 / GHSA-2f9x-5v75-3qv4

More information

Details

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-7537
• https://access.redhat.com/errata/RHSA-2018:2927
• https://access.redhat.com/errata/RHSA-2019:0265
• https://github.com/advisories/GHSA-2f9x-5v75-3qv4
• https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html
• https://www.debian.org/security/2018/dsa-4161
• https://github.com/django/django/commit/94c5da1d17a6b0d378866c66b605102c19f7988c
• https://github.com/django/django/commit/a91436360b79a6ff995c3e5018bcc666dfaf1539
• https://github.com/django/django/commit/d17974a287a6ea2e361daff88fcc004cbd6835fa
• https://usn.ubuntu.com/3591-1
• https://www.djangoproject.com/weblog/2018/mar/06/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2018-6.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django open redirect

CVE-2017-7234 / GHSA-h4hv-m4h4-mhwg

More information

Details

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the django.views.static.serve() view could redirect to any other domain, aka an open redirect vulnerability.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-7234
• https://github.com/advisories/GHSA-h4hv-m4h4-mhwg
• http://www.debian.org/security/2017/dsa-3835
• https://web.archive.org/web/20170429023907/http://www.securitytracker.com/id/1038177
• https://web.archive.org/web/20170526042328/http://www.securityfocus.com/bid/97401
• https://github.com/django/django/commit/2a9f6ef71b8e23fd267ee2be1be26dde8ab67037
• https://github.com/django/django/commit/4a6b945dffe8d10e7cec107d93e6efaebfbded29
• https://github.com/django/django/commit/5f1ffb07afc1e59729ce2b283124116d6c0659e4
• https://www.djangoproject.com/weblog/2017/apr/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-10.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Potential account hijack via password reset form

CVE-2019-19844 / GHSA-vfq6-hq5r-27r6

More information

Details

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-19844
• https://github.com/django/django/commit/5b1fbcef7a8bec991ebe7b2a18b5d5a95d72cb70
• https://github.com/django/django/commit/f4cff43bf921fcea6a29b726eb66767f67753fa2
• https://groups.google.com/forum/#!topic/django-announce/3oaB2rVH3a0
• https://seclists.org/bugtraq/2020/Jan/9
• https://www.debian.org/security/2020/dsa-4598
• http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html
• https://security.gentoo.org/glsa/202004-17
• https://github.com/django/django/commit/302a4ff1e8b1c798aab97673909c7a3dfda42c26
• https://github.com/django/django/commit/4d334bea06cac63dc1272abcec545b85136cca0e
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/advisories/GHSA-vfq6-hq5r-27r6
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-16.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD
• https://security.netapp.com/advisory/ntap-20200110-0003
• https://usn.ubuntu.com/4224-1
• https://www.djangoproject.com/weblog/2019/dec/18/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

SQL injection in Django

CVE-2020-7471 / GHSA-hmr4-m2h5-33qx

More information

Details

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-7471
• https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136
• https://groups.google.com/forum/#!topic/django-announce/X45S86X5bZI
• https://www.openwall.com/lists/oss-security/2020/02/03/1
• http://www.openwall.com/lists/oss-security/2020/02/03/1
• https://seclists.org/bugtraq/2020/Feb/30
• https://security.gentoo.org/glsa/202004-17
• https://www.debian.org/security/2020/dsa-4629
• https://github.com/django/django/commit/001b0634cd309e372edb6d7d95d083d02b8e37bd
• https://github.com/django/django/commit/505826b469b16ab36693360da9e11fd13213421b
• https://github.com/django/django/commit/c67a368c16e4680b324b4f385398d638db4d8147
• https://www.djangoproject.com/weblog/2020/feb/03/security-releases
• https://usn.ubuntu.com/4264-1
• https://security.netapp.com/advisory/ntap-20200221-0006
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-35.yaml
• https://github.com/advisories/GHSA-hmr4-m2h5-33qx
• https://docs.djangoproject.com/en/3.0/releases/security

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Path Traversal in Django

CVE-2021-33203 / GHSA-68w8-qjq3-2gfm

More information

Details

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-33203
• https://groups.google.com/forum/#!forum/django-announce
• https://github.com/django/django/commit/053cc9534d174dc89daba36724ed2dcb36755b90
• https://github.com/django/django/commit/20c67a0693c4ede2b09af02574823485e82e4c8f
• https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b1c5b9
• https://docs.djangoproject.com/en/3.2/releases/security
• https://github.com/advisories/GHSA-68w8-qjq3-2gfm
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-98.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
• https://security.netapp.com/advisory/ntap-20210727-0004
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Cross-site scripting Vulnerability

CVE-2016-6186 / GHSA-c8c8-9472-w52h

More information

Details

Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-6186
• https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
• https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d
• http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html
• http://rhn.redhat.com/errata/RHSA-2016-1594.html
• http://rhn.redhat.com/errata/RHSA-2016-1595.html
• http://rhn.redhat.com/errata/RHSA-2016-1596.html
• http://seclists.org/fulldisclosure/2016/Jul/53
• http://www.debian.org/security/2016/dsa-3622
• http://www.ubuntu.com/usn/USN-3039-1
• http://www.vulnerability-lab.com/get_content.php?id=1869
• https://web.archive.org/web/20201022155237/http://www.securityfocus.com/archive/1/538947/100/0/threaded
• https://web.archive.org/web/20210123154652/http://www.securityfocus.com/bid/92058
• https://web.archive.org/web/20211204042848/http://www.securitytracker.com/id/1036338
• https://github.com/django/django/commit/6fa150b2f8b601668083042324c4add534143cb1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DMLLFAUT4J4IP4P2KI4NOVWRMHA22WUJ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KHHPN6MISX5I6UTXQHYLPTLEEUE6WDXW
• https://www.djangoproject.com/weblog/2016/jul/18/security-releases
• https://www.exploit-db.com/exploits/40129
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-2.yaml
• https://github.com/advisories/GHSA-c8c8-9472-w52h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django CSRF Protection Bypass

CVE-2016-7401 / GHSA-crhm-qpjc-cm64

More information

Details

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-7401
• http://rhn.redhat.com/errata/RHSA-2016-2038.html
• http://rhn.redhat.com/errata/RHSA-2016-2039.html
• http://rhn.redhat.com/errata/RHSA-2016-2040.html
• http://rhn.redhat.com/errata/RHSA-2016-2041.html
• http://rhn.redhat.com/errata/RHSA-2016-2042.html
• http://rhn.redhat.com/errata/RHSA-2016-2043.html
• http://www.debian.org/security/2016/dsa-3678
• http://www.ubuntu.com/usn/USN-3089-1
• https://web.archive.org/web/20200227223637/http://www.securityfocus.com/bid/93182
• https://web.archive.org/web/20210927195154/http://www.securitytracker.com/id/1036899
• https://github.com/django/django/commit/6fe846a8f08dc959003f298b5407e321c6fe3735
• https://github.com/django/django/commit/6118ab7d0676f0d622278e5be215f14fb5410b6a
• https://github.com/django/django/commit/d1bc980db1c0fffd6d60677e62f70beadb9fe64a
• https://www.djangoproject.com/weblog/2016/sep/26/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-3.yaml
• https://github.com/advisories/GHSA-crhm-qpjc-cm64

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Reflected File Download attack

CVE-2022-36359 / GHSA-8x94-hmjh-97hq

More information

Details

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-36359
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-245.yaml
• https://groups.google.com/g/django-announce/c/8cz--gvaJr4
• http://www.openwall.com/lists/oss-security/2022/08/03/1
• https://www.debian.org/security/2022/dsa-5254
• https://github.com/django/django/commit/b3e4494d759202a3b6bf247fd34455bf13be5b80
• https://github.com/django/django/commit/b7d9529cbe0af4adabb6ea5d01ed8dcce3668fb3
• https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
• https://docs.djangoproject.com/en/4.0/releases/security
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
• https://security.netapp.com/advisory/ntap-20220915-0008
• https://www.djangoproject.com/weblog/2022/aug/03/security-releases
• https://github.com/advisories/GHSA-8x94-hmjh-97hq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django user with hardcoded password created when running tests on Oracle

CVE-2016-9013 / GHSA-mv8g-fhh6-6267

More information

Details

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-9013
• http://www.debian.org/security/2017/dsa-3835
• http://www.ubuntu.com/usn/USN-3115-1
• https://github.com/django/django/commit/34e10720d81b8d407aa14d763b6a7fe8f13b4f2e
• https://github.com/django/django/commit/4844d86c7728c1a5a3bbce4ad336a8d32304072b
• https://github.com/django/django/commit/70f99952965a430daf69eeb9947079aae535d2d0
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-17.yaml
• https://github.com/advisories/GHSA-mv8g-fhh6-6267

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django open redirect and possible XSS attack via user-supplied numeric redirect URLs

CVE-2017-7233 / GHSA-37hp-765x-j95x

More information

Details

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url()) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-7233
• https://access.redhat.com/errata/RHSA-2017:1445
• https://access.redhat.com/errata/RHSA-2017:1451
• https://access.redhat.com/errata/RHSA-2017:1462
• https://access.redhat.com/errata/RHSA-2017:1470
• https://access.redhat.com/errata/RHSA-2017:1596
• https://access.redhat.com/errata/RHSA-2017:3093
• https://access.redhat.com/errata/RHSA-2018:2927
• https://github.com/advisories/GHSA-37hp-765x-j95x
• http://www.debian.org/security/2017/dsa-3835
• https://github.com/django/django/commit/254326cb3682389f55f886804d2c43f7b9f23e4f
• https://github.com/django/django/commit/8339277518c7d8ec280070a780915304654e3b66
• https://github.com/django/django/commit/f824655bc2c50b19d2f202d7640785caabc82787
• https://www.djangoproject.com/weblog/2017/apr/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-9.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django DNS Rebinding Vulnerability

CVE-2016-9014 / GHSA-3f2c-jm6v-cr35

More information

Details

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Severity

• CVSS Score: 9.2 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-9014
• http://www.debian.org/security/2017/dsa-3835
• http://www.ubuntu.com/usn/USN-3115-1
• https://web.archive.org/web/20210123185619/http://www.securityfocus.com/bid/94068
• https://web.archive.org/web/20211204043252/http://www.securitytracker.com/id/1037159
• https://github.com/django/django/commit/45acd6d836895a4c36575f48b3fb36a3dae98d19
• https://github.com/django/django/commit/884e113838e5a72b4b0ec9e5e87aa480f6aa4472
• https://github.com/django/django/commit/c401ae9a7dfb1a94a8a61927ed541d6f93089587
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2016-18.yaml
• https://github.com/advisories/GHSA-3f2c-jm6v-cr35

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django denial-of-service possibility in urlize and urlizetrunc template filters

CVE-2018-7536 / GHSA-r28v-mw67-m5p9

More information

Details

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-7536
• https://access.redhat.com/errata/RHSA-2018:2927
• https://access.redhat.com/errata/RHSA-2019:0051
• https://access.redhat.com/errata/RHSA-2019:0082
• https://access.redhat.com/errata/RHSA-2019:0265
• https://github.com/advisories/GHSA-r28v-mw67-m5p9
• https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html
• https://www.debian.org/security/2018/dsa-4161
• https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2
• https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16
• https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2018-5.yaml
• https://usn.ubuntu.com/3591-1
• https://web.archive.org/web/20200227131019/http://www.securityfocus.com/bid/103361
• https://www.djangoproject.com/weblog/2018/mar/06/security-releases

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://github.com/advisories/GHSA-rrqc-c2jx-6jgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

CVE-2025-48432 / GHSA-7xr5-9hcq-chf9

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jun/04/security-releases
• http://www.openwall.com/lists/oss-security/2025/06/04/5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
• https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
• http://www.openwall.com/lists/oss-security/2025/06/10/2
• http://www.openwall.com/lists/oss-security/2025/06/10/3
• http://www.openwall.com/lists/oss-security/2025/06/10/4
• https://github.com/advisories/GHSA-7xr5-9hcq-chf9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is subject to SQL injection through its column aliases

CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml
• https://github.com/advisories/GHSA-6w2r-r2m5-xq5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
• https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml
• https://github.com/advisories/GHSA-frmv-pr5f-9mcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
• https://github.com/advisories/GHSA-qw25-v68c-qjf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (django)

v4.2.26

Compare Source

v4.2.25

Compare Source

v4.2.24

Compare Source

v4.2.23

Compare Source

v4.2.22

Compare Source

v4.2.21

Compare Source

v4.2.20

Compare Source

v4.2.19

Compare Source

v4.2.18

Compare Source

v4.2.17

Compare Source

v4.2.16

Compare Source

v4.2.15

Compare Source

v4.2.14

Compare Source

v4.2.13

Compare Source

v4.2.12

Compare Source

v4.2.11

Compare Source

v4.2.10

Compare Source

v4.2.9

Compare Source

v4.2.8

Compare Source

v4.2.7

Compare Source

v4.2.6

Compare Source

v4.2.5

Compare Source

v4.2.4

Compare Source

v4.2.3

Compare Source

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2

Compare Source

v4.1.13

Compare Source

v4.1.12

Compare Source

v4.1.11

Compare Source

v4.1.10

Compare Source

v4.1.9

Compare Source

v4.1.8

Compare Source

v4.1.7

Compare Source

v4.1.6

Compare Source

v4.1.5

Compare Source

v4.1.4

Compare Source

v4.1.3

Compare Source

v4.1.2

Compare Source

v4.1.1

Compare Source

v4.1

Compare Source

v4.0.10

[Compare Source](https://redirect.github.com/d

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.