Medium DSA-5186-1 2 CVEs

djangorestframework - security update

Published Jul 22, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	djangorestframework	3.9.0-1+deb10u1

Vulnerabilities 2

Medium 6.1

CVE-2018-25045

Django REST framework XSS Vulnerability

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

djangorestframework djangorestframework django-rest-framework Debian Ubuntu PyPI

Jul 23, 2022
Medium 6.1

CVE-2020-25626

Cross-site Scripting (XSS) in Django REST Framework

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those st…

djangorestframework djangorestframework djangorestframework Debian Ubuntu PyPI

Sep 30, 2020