Description
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.7.7-1 | — |
| Debian 13 | python-django | 1.7.7-1 | — |
| Debian 12 | python-django | 1.7.7-1 | — |
| Debian 7 | python-django | 1.4.5-1+deb7u11 | DSA-3204-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze13 | DLA-272-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.8 | USN-2539-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 1.0 | python-Django | 1.6.11-4.1 | SUSE-SU-2015:1112-1, SUSE-SU-2015:1109-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.4.20 | 1.4.20 | GHSA-7fq8-4pv5-5w5c |
| PyPI | django | >= 1.5, < 1.6.11 | 1.6.11 | GHSA-7fq8-4pv5-5w5c |
| PyPI | django | >= 1.7, < 1.7.7 | 1.7.7 | GHSA-7fq8-4pv5-5w5c |
| PyPI | django | >= 1.8a1, < 1.8c1 | 1.8c1 | GHSA-7fq8-4pv5-5w5c |
| PyPI | django | < 1.4.20 · >= 1.5, < 1.6.11 · >= 1.7, < 1.7.7 · >= 1.8a0, < 1.8c1 | 1.4.20, 1.6.11, 1.7.7, 1.8c1 | PYSEC-2015-9 |
Advisories 5
- DSA-3204-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-272-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2539-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:1112-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1109-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-2539-1 vendor-advisory
- 73319 vdb-entry
- DSA-3204 vendor-advisory
- FEDORA-2015-5766 vendor-advisory
- openSUSE-SU-2015:1598 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- MDVSA-2015:195 vendor-advisory
- openSUSE-SU-2015:0643 vendor-advisory
- FEDORA-2015-9604 vendor-advisory
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/