GitHub Advisoryadvisory · PyPI

GHSA-x9jp-4w8m-4f3c Cross Site Scripting vulnerability in django-jsonform's admin form.

HIGH Published 2022-06-10 Modified 2022-06-10 Official page ↗
Ecosystem
PyPI
Packages
django-jsonform
Severity
High
Weaknesses
CWE-79, CWE-80
Reviewed
2022-06-10

Affected packages

• PyPI django-jsonform: < 2.10.1 → fixed in 2.10.1

Description

Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks. This only affects the admin pages where the django-jsonform is rendered. Mitigation Upgrade to django-jsonform version 2.10.1 or later. For more information If you have any questions or comments about this advisory: • Open an issue. • Email the maintainer at `Bharat Chauhan `.

Related

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References