djangorestframework

djangorestframework

Python Package Index

www.django-rest-framework.org

Releases140

Frequency1 month 1 week

Last Release4 months ago

Web APIs for Django, made easy.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2024-21520OSV↗	< 3.15.2	Jun 26, 2024Wednesday, 26 June 2024, 05:15	6.1 MEDIUM	—
Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
CVE-2020-25626OSV↗	< 3.12.0, < 3.11.2	Sep 30, 2020Wednesday, 30 September 2020, 20:15	6.1 MEDIUM	4.3 MEDIUM
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.