Vulnerability	Vulnerable Version
L Improper Encoding or Escaping of Output django-tomselect is a Django autocomplete widgets and views using Tom Select Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in form widget input, including the `label_field` parameter. An attacker can hide the contents between `<script>` tags in code from appearing in the output, since the browser may interpret and render the tags. Although injected, such scripts are not executed. How to fix Improper Encoding or Escaping of Output? Upgrade `django-tomselect` to version 2025.3.3 or higher.	[,2025.3.3)

Improper Encoding or Escaping of Output

django-tomselect is a Django autocomplete widgets and views using Tom Select

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in form widget input, including the label_field parameter. An attacker can hide the contents between <script> tags in code from appearing in the output, since the browser may interpret and render the tags. Although injected, such scripts are not executed.

How to fix Improper Encoding or Escaping of Output?

Upgrade django-tomselect to version 2025.3.3 or higher.

[,2025.3.3)

Go back to all versions of this package