Django@5.2.16

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the spatial lookup handling in django/contrib/gis/db/models/fields.py and django/contrib/gis/gdal/raster/source.py. An attacker can cause the Django process to make network requests by supplying attacker-controlled bytes to a raster lookup that is processed as a GDAL raster input. The vulnerable code accepts bytes in lookup contexts without requiring explicit GDALRaster wrapping, and GDAL can interpret that data as a VRT document referencing external raster sources. This lets an attacker trigger outbound file or network access while the lookup is being prepared, exposing the application to unintended requests made as the Django process user.

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through forged model formset submissions. An attacker can delete objects outside the formset’s limiting queryset by submitting POST data that supplies an editable primary key for a newly constructed instance and marks it for deletion. This lets an authenticated user with permission to submit the formset remove rows they are not authorized to target, while models with the default AutoField primary key are not affected.

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to quadratic-time parsing in django.utils.http.parse_header_parameters() within django/utils/http.py. An attacker can exhaust CPU by sending an unauthenticated request with an Accept or Content-Type header containing many separators inside a quoted parameter. This slows or stalls request processing in code paths such as HttpRequest.accepts(), degrading service for other users and making the application unresponsive under repeated malicious requests.

Upgrade Django to version 5.2.18, 6.0.9, 6.1.2 or higher.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the check_for_language function. An attacker can exhaust system memory by submitting numerous unique, excessively long language codes, which are stored as keys in an in-memory cache.

Note: This is only exploitable if the set_language view is explicitly routed in the application.

Upgrade Django to version 5.2.17, 6.0.8, 6.1 or higher.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the display_for_field function. An attacker can execute arbitrary JavaScript code in the context of the admin interface by storing a URL with an unsafe scheme directly in the database, which is then rendered as a clickable link and clicked by a staff user.

Note: This is only exploitable if data is persisted to the database without model validation, such as through direct queryset writes, deserialization, or bulk import of untrusted input.

Upgrade Django to version 5.2.17, 6.0.8, 6.1 or higher.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Uncontrolled Recursion via GEOSGeometry when parsing deeply nested GEOMETRYCOLLECTION objects provided as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB. An attacker can cause unbounded recursion and trigger a segmentation fault in the underlying GEOS library by supplying maliciously crafted input through spatial field lookups or the GeometryField form field.

Upgrade Django to version 5.2.17, 6.0.8, 6.1 or higher.