CVE-2018-25045

Django REST framework XSS Vulnerability

6.1 MediumFix available

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.78%Down 0.1 points since Jul 23, 2022

What each source reports

NVD Score used 6.1

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: CVE-2018-25045
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: CVE-2018-25045
Updated: 2026-11-02

EUVDEUVD-2022-6453 No score

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: EUVD-2022-6453
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xqcf-hj92-967m 6.1

Django REST framework XSS Vulnerability

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: GHSA-xqcf-hj92-967m
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: CVE-2018-25045
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-25045 6.1

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: DEBIAN-CVE-2018-25045
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-xqcf-hj92-967m 6.1

Django REST framework XSS Vulnerability

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: GHSA-xqcf-hj92-967m
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2026-804 6.1

Django REST framework XSS Vulnerability

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: PYSEC-2026-804
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-25045 6.1

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

Record: UBUNTU-CVE-2018-25045
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

django-rest-framework django rest framework

Affected packages

Affected packages
Package	Affected	Fixed
`django-rest-framework` PyPI	before 3.9.1	3.9.1
`djangorestframework` Debian:12	before 3.10.2-1	3.10.2-1
`djangorestframework` Debian:13	before 3.10.2-1	3.10.2-1
`djangorestframework` Debian:14	before 3.10.2-1	3.10.2-1
`djangorestframework` Debian:10 From an advisory covering 2 CVEs	before 3.9.0-1+deb10u1, plus listed versions 3.9.0-1	3.9.0-1+deb10u1
`django-rest-framework` PyPI	before 3.9.1, plus listed versions 0.1.0	3.9.1
`djangorestframework` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.3-23.3.1-13.3.2-13.3.2-2	None known
`djangorestframework` Ubuntu:18.04:LTS	All versions, plus listed versions 3.4.0-23.7.7-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-25045 is a medium vulnerability (CVSS 6.1) in Django-rest-framework Django Rest Framework, published July 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in django-rest-framework 3.9.1.

References

Show 4 moreShow less