← All advisories

Medium severity6.1NVD Advisory· Published Jul 23, 2022· Updated Jun 17, 2026

CVE-2018-25045

CVE-2018-25045

Description

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
django-rest-frameworkPyPI	< 3.9.1	3.9.1

Affected products

3

Djangoproject/Django REST frameworkcpe-rescue
Django Rest Framework/Django Rest Framework
cpe:2.3:a:django-rest-framework:django_rest_framework:*:*:*:*:*:*:*:*
Range: <3.9.1
ghsa-coords
pkg:pypi/django-rest-framework
Range: < 3.9.1

Patches

Vulnerability mechanics

References

5

github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8nvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-xqcf-hj92-967mghsaADVISORY
github.com/encode/django-rest-framework/pull/6191nvdThird Party AdvisoryWEB
github.com/encode/django-rest-framework/pull/6330nvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2018-25045ghsaADVISORY

News mentions

0

No linked articles in our index yet.