Description
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | python-django-grappelli | 2.14.4-bp155.3.3.1 | openSUSE-SU-2024:0017-1 |
| SUSE Package Hub 15 SP4 | python-django-grappelli | 2.14.4-bp154.2.3.1 | openSUSE-SU-2023:0384-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | python-django-grappelli | 2.14.4-bp155.3.3.1 | openSUSE-SU-2024:0017-1 |
| openSUSE Leap 15.4 | python-django-grappelli | 2.14.4-bp154.2.3.1 | openSUSE-SU-2023:0384-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django-grappelli | < 2.15.2 | 2.15.2 | GHSA-9x43-5qcq-h79q |
Advisories 2
- openSUSE-SU-2023:0384-1 Security update for python-django-grappelli SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0017-1 Security update for python-django-grappelli SUSE / openSUSE Security Updates · Feb 4, 2026