p PatchFirst

CVE-2020-25626

CVE-2020-25626

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.

CVSS 6.1 · Medium · EPSS 1.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • django rest framework

    Versions
    • All django-rest-framework versions before 3.12.0 and before 3.11.2: Affected

    No fix published

  • djangorestframework Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.12.1-1

    Update to 3.12.1-1

  • djangorestframework Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.12.1-1

    Update to 3.12.1-1

  • djangorestframework Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.12.1-1

    Update to 3.12.1-1

  • djangorestframework PyPI

    Versions
    • 0.1
    • 0.1.1
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.4.0
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    • 2.1.10
    • 2.1.11
    • 2.1.12
    • 2.1.13
    • 2.1.14
    • 2.1.15
    • 2.1.16
    • 2.1.17
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.1.9
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.3.0
    • 2.3.1
    • 2.3.10
    • 2.3.11
    • 2.3.12
    • 2.3.13
    • 2.3.14
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.3.5
    • 2.3.6
    • 2.3.7
    • 2.3.8
    • 2.3.9
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.4.4
    • 2.4.5
    • 2.4.6
    • 2.4.7
    • 2.4.8
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.1.0
    • 3.1.1
    • 3.1.2
    • 3.1.3
    • 3.10.0
    • 3.10.1
    • 3.10.2
    • 3.10.3
    • 3.11.0
    • 3.11.1
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.3.3
    • 3.4.0
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.4.7
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.5.3
    • 3.5.4
    • 3.6.0
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    • 3.7.4
    • 3.7.5
    • 3.7.6
    • 3.7.7
    • 3.8.0
    • 3.8.1
    • 3.8.2
    • 3.9.0
    • 3.9.1
    • 3.9.2
    • 3.9.3
    • 3.9.4
    Affected ranges
    • ECOSYSTEM: < 3.11.2

    Update to 3.11.2

  • djangorestframework Ubuntu:16.04:LTS

    Versions
    • 2.4.3-2
    • 3.3.1-1
    • 3.3.2-1
    • 3.3.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:18.04:LTS

    Versions
    • 3.4.0-2
    • 3.7.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:20.04:LTS

    Versions
    • 3.9.0-2
    • 3.10.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:22.04:LTS

    Versions
    • 3.12.1-1
    • 3.12.4-1
    • 3.12.4-2
    • 3.12.4-2ubuntu1
    • 3.12.4-2.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:24.04:LTS

    Versions
    • 3.14.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:25.10

    Versions
    • 3.15.2-2
    • 3.16.0-1
    • 3.16.0-1ubuntu1
    • 3.16.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:26.10

    Versions
    • 3.16.1-3
    • 3.16.1-4
    • 3.17.1+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • djangorestframework Ubuntu:26.04:LTS

    Versions
    • 3.16.1-1
    • 3.16.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →