chore(deps): update dependency django to v5 [security]

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
Django (changelog)	==4.2.10 → ==5.2.16
Django (changelog)	==4.2.9 → ==5.2.16
django (changelog)	==4.2.10 → ==5.2.16

---

Django denial-of-service attack in the intcomma template filter

CVE-2024-24680 / GHSA-xxj9-f6rv-m3x4

More information

Details

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-24680
• https://groups.google.com/forum/#%21forum/django-announce
• https://github.com/django/django/commit/16a8fe18a3b81250f4fa57e3f93f0599dc4895bc
• https://github.com/django/django/commit/55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9
• https://github.com/django/django/commit/572ea07e84b38ea8de0551f4b4eda685d91d09d2
• https://github.com/django/django/commit/c1171ffbd570db90ca206c30f8e2b9f691243820
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-28.yaml
• https://docs.djangoproject.com/en/5.0/releases/security
• https://www.djangoproject.com/weblog/2024/feb/06/security-releases
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://github.com/advisories/GHSA-xxj9-f6rv-m3x4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Regular expression denial-of-service in Django

CVE-2024-27351 / GHSA-vm8q-m57g-pff3

More information

Details

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-27351
• https://docs.djangoproject.com/en/5.0/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/mar/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-47.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• http://www.openwall.com/lists/oss-security/2024/03/04/1
• https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521
• https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e
• https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6
• https://github.com/advisories/GHSA-vm8q-m57g-pff3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Denial of Service

CVE-2024-38875 / GHSA-qg2p-9jwr-mmqf

More information

Details

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-38875
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/jul/09/security-releases
• https://github.com/django/django/commit/7285644640f085f41d60ab0c8ae4e9153f0485db
• https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-56.yaml
• https://security.netapp.com/advisory/ntap-20240808-0005
• https://github.com/advisories/GHSA-qg2p-9jwr-mmqf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Path Traversal vulnerability

CVE-2024-39330 / GHSA-9jmf-237g-qf46

More information

Details

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-39330
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/jul/09/security-releases
• https://github.com/django/django/commit/2b00edc0151a660d1eb86da4059904a0fc4e095e
• https://github.com/django/django/commit/9f4f63e9ebb7bf6cb9547ee4e2526b9b96703270
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-58.yaml
• https://security.netapp.com/advisory/ntap-20240808-0005
• https://github.com/advisories/GHSA-9jmf-237g-qf46

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to user enumeration attack

CVE-2024-39329 / GHSA-x7q2-wr7g-xqmf

More information

Details

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-39329
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/jul/09/security-releases
• https://github.com/django/django/commit/07cefdee4a9d1fcd9a3a631cbd07c78defd1923b
• https://github.com/django/django/commit/156d3186c96e3ec2ca73b8b25dc2ef366e38df14
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-57.yaml
• https://security.netapp.com/advisory/ntap-20240808-0005
• https://github.com/advisories/GHSA-x7q2-wr7g-xqmf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Denial of Service

CVE-2024-39614 / GHSA-f6f8-9mx6-9mx2

More information

Details

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-39614
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/jul/09/security-releases
• https://github.com/django/django/commit/17358fb35fb7217423d4c4877ccb6d1a3a40b1c3
• https://github.com/django/django/commit/8e7a44e4bec0f11474699c3111a5e0a45afe7f49
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-59.yaml
• https://security.netapp.com/advisory/ntap-20240808-0005
• https://github.com/advisories/GHSA-f6f8-9mx6-9mx2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django memory consumption vulnerability

CVE-2024-41989 / GHSA-jh75-99hh-qvx9

More information

Details

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-41989
• https://docs.djangoproject.com/en/dev/releases/security
• https://www.djangoproject.com/weblog/2024/aug/06/security-releases
• https://github.com/django/django/commit/27900fe56f3d3cabb4aeb6ccb82f92bab29073a8
• https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-67.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://security.netapp.com/advisory/ntap-20240905-0007
• https://github.com/advisories/GHSA-jh75-99hh-qvx9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to a denial-of-service attack

CVE-2024-41990 / GHSA-795c-9xpc-xw6g

More information

Details

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-41990
• https://docs.djangoproject.com/en/dev/releases/security
• https://www.djangoproject.com/weblog/2024/aug/06/security-releases
• https://github.com/django/django/commit/7b7b909579c8311c140c89b8a9431bf537febf93
• https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-68.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://security.netapp.com/advisory/ntap-20240905-0007
• https://github.com/advisories/GHSA-795c-9xpc-xw6g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django SQL injection vulnerability

CVE-2024-42005 / GHSA-pv4p-cwwg-4rph

More information

Details

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-42005
• https://docs.djangoproject.com/en/dev/releases/security
• https://www.djangoproject.com/weblog/2024/aug/06/security-releases
• https://github.com/django/django/commit/32ebcbf2e1fe3e5ba79a6554a167efce81f7422d
• https://github.com/django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab28
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-70.yaml
• https://groups.google.com/forum/#%21forum/django-announce
• https://security.netapp.com/advisory/ntap-20240905-0007
• https://github.com/advisories/GHSA-pv4p-cwwg-4rph

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to denial-of-service attack

CVE-2024-41991 / GHSA-r836-hh6v-rg5g

More information

Details

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-41991
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/aug/06/security-releases
• https://github.com/django/django/commit/523da8771bce321023f490f70d71a9e973ddc927
• https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-69.yaml
• https://security.netapp.com/advisory/ntap-20240905-0007
• https://github.com/advisories/GHSA-r836-hh6v-rg5g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

CVE-2024-45230 / GHSA-5hgc-2vfp-mqvc

More information

Details

An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45230
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/022ab0a75c76ab2ea31dfcc5f2cf5501e378d397
• https://github.com/django/django/commit/813de2672bd7361e9a453ab62cd6e52f96b6525b
• https://github.com/django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-102.yaml
• https://github.com/advisories/GHSA-5hgc-2vfp-mqvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django allows enumeration of user e-mail addresses

CVE-2024-45231 / GHSA-rrqc-c2jx-6jgv

More information

Details

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-45231
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/forum/#%21forum/django-announce
• https://www.djangoproject.com/weblog/2024/sep/03/security-releases
• https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca
• https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2
• https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199
• https://github.com/advisories/GHSA-rrqc-c2jx-6jgv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django SQL injection in HasKey(lhs, rhs) on Oracle

CVE-2024-53908 / GHSA-m9g8-fxxm-xg86

More information

Details

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

Severity

• CVSS Score: 7.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-53908
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.openwall.com/lists/oss-security/2024/12/04/3
• https://www.djangoproject.com/weblog/2024/dec/04/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-157.yaml
• https://github.com/advisories/GHSA-m9g8-fxxm-xg86

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django denial-of-service in django.utils.html.strip_tags()

CVE-2024-53907 / GHSA-8498-2h75-472j

More information

Details

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-53907
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.openwall.com/lists/oss-security/2024/12/04/3
• https://www.djangoproject.com/weblog/2024/dec/04/security-releases
• https://lists.debian.org/debian-lts-announce/2024/12/msg00028.html
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-156.yaml
• https://github.com/advisories/GHSA-8498-2h75-472j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a potential denial-of-service vulnerability in IPv6 validation

CVE-2024-56374 / GHSA-qcgg-j2x8-h9g8

More information

Details

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.)

Severity

• CVSS Score: 5.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-56374
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jan/14/security-releases
• http://www.openwall.com/lists/oss-security/2025/01/14/2
• https://github.com/django/django/commit/ca2be7724e1244a4cb723de40a070f873c6e94bf
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-1.yaml
• https://lists.debian.org/debian-lts-announce/2025/01/msg00024.html
• https://github.com/django/django/commit/4806731e58f3e8700a3c802e77899d54ac6021fe
• https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e
• https://github.com/django/django/commit/e8d4a2005955dcf962193600b53bf461b190b455
• https://github.com/advisories/GHSA-qcgg-j2x8-h9g8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to Allocation of Resources Without Limits or Throttling

CVE-2025-26699 / GHSA-p3fp-8748-vqfq

More information

Details

An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-26699
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/mar/06/security-releases
• http://www.openwall.com/lists/oss-security/2025/03/06/12
• https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-13.yaml
• https://github.com/advisories/GHSA-p3fp-8748-vqfq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service possibility in strip_tags()

CVE-2025-32873 / GHSA-8j24-cjrq-gr2m

More information

Details

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-32873
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/may/07/security-releases
• http://www.openwall.com/lists/oss-security/2025/05/07/1
• https://github.com/django/django/commit/9f3419b519799d69f2aba70b9d25abe2e70d03e0
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-37.yaml
• https://github.com/advisories/GHSA-8j24-cjrq-gr2m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

CVE-2025-48432 / GHSA-7xr5-9hcq-chf9

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jun/04/security-releases
• http://www.openwall.com/lists/oss-security/2025/06/04/5
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
• https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
• http://www.openwall.com/lists/oss-security/2025/06/10/2
• http://www.openwall.com/lists/oss-security/2025/06/10/3
• http://www.openwall.com/lists/oss-security/2025/06/10/4
• https://github.com/advisories/GHSA-7xr5-9hcq-chf9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is subject to SQL injection through its column aliases

CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• http://www.openwall.com/lists/oss-security/2025/09/03/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-105.yaml
• https://github.com/advisories/GHSA-6w2r-r2m5-xq5w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to partial directory traversal via archives

CVE-2025-59682 / GHSA-q95w-c7qg-hrff

More information

Details

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59682
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
• https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
• http://www.openwall.com/lists/oss-security/2025/10/01/3
• https://github.com/advisories/GHSA-q95w-c7qg-hrff

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection in column aliases

CVE-2025-59681 / GHSA-hpr9-3m2g-3j9p

More information

Details

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59681
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases
• https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
• http://www.openwall.com/lists/oss-security/2025/10/01/3
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-106.yaml
• https://github.com/advisories/GHSA-hpr9-3m2g-3j9p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-107.yaml
• https://github.com/advisories/GHSA-qw25-v68c-qjf3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html
• https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-108.yaml
• https://github.com/advisories/GHSA-frmv-pr5f-9mcr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is vulnerable to SQL injection in column aliases

CVE-2025-13372 / GHSA-rqw2-ghq9-44m7

More information

Details

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-13372
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/dec/02/security-releases
• https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf
• https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0
• https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e
• https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355
• https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-104.yaml
• https://github.com/advisories/GHSA-rqw2-ghq9-44m7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Django is vulnerable to DoS via XML serializer text extraction

✂ Note

PR body was truncated to here.

[dpebot]

/gcbrun

[gemini-code-assist]

Code Review

This pull request updates the Django dependency across several requirements files to address security vulnerabilities. While most instances are updated to version 4.2.20, the update in 'python/django/python-guestbook/src/requirements.txt' only reaches version 4.2.18, which remains vulnerable to CVE-2025-26699. It is recommended to use version 4.2.20 consistently to ensure all security issues are resolved.

[gemini-code-assist]

The Django version in this file is being updated to 4.2.18, which is inconsistent with the other updates in this PR that use 4.2.20. Version 4.2.18 remains vulnerable to CVE-2025-26699 (fixed in 4.2.20), which is listed in the PR description. It is recommended to update this to 4.2.20 to ensure all security vulnerabilities are addressed consistently.

Django==4.2.20

[dpebot]

/gcbrun

[dpebot]

/gcbrun