Cross Site Scripting vulnerability in django-jsonform's admin form.
Description
django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks.
This only affects the admin pages where the django-jsonform is rendered.
Mitigation
Upgrade to django-jsonform version 2.10.1 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue.
- Email the maintainer at
Bharat Chauhan <tell.bhch@gmail.com>.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | django-jsonform | < 2.10.1 | 2.10.1 |
References
- Weakness (CWE)
CWE-79, CWE-80- Platform
- Python (PyPI)
- Package
django-jsonform- Disclosed
- 10.06.2022
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-x9jp-4w8m-4f3c - CC BY 4.0
Vulnerability history: django-jsonform
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.