VYPR
Get started
← All advisories
Critical severityNVD Advisory· Published Feb 3, 2025· Updated Apr 15, 2026

CVE-2025-24370

CVE-2025-24370

Description

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality set_property_value, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five ways of vulnerability exploitation have been observed, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. This issue has been addressed in version 0.62.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
django-unicornPyPI
< 0.62.00.62.0

Patches

3
d62c2d0880ca
https://github.com/adamghill/django-unicornvia osv
17614200f271
https://github.com/django-commons/django-unicornvia osv
17614200f271

Merge commit from fork

https://github.com/adamghill/django-unicornAdam HillJan 26, 2025via ghsa
commit
1 file changed · +3 −0
  • django_unicorn/views/action_parsers/utils.py+3 −0 modified
    @@ -50,6 +50,9 @@ class TestView(UnicornView):
     The following code updates UnicornView.author.name based the payload's `author.name`.
     """
     property_name_parts = property_name.split(".")
+    for part in property_name_parts:
+        if part.startswith("__") and part.endswith("__"):
+            raise AssertionError("Invalid property name")
     component_or_field = component
     data_or_dict = data  # Could be an internal portion of data that gets set

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.