GHSA-x9jp-4w8m-4f3c
Cross Site Scripting vulnerability in django-jsonform's admin form.
Description
django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks.
This only affects the admin pages where the django-jsonform is rendered.
Mitigation
Upgrade to django-jsonform version 2.10.1 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue.
- Email the maintainer at
Bharat Chauhan <tell.bhch@gmail.com>.
What each source reports
GitHub AdvisoriesNo score
Cross Site Scripting vulnerability in django-jsonform's admin form.
Description
django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks.
This only affects the admin pages where the django-jsonform is rendered.
Mitigation
Upgrade to django-jsonform version 2.10.1 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue.
- Email the maintainer at
Bharat Chauhan <tell.bhch@gmail.com>.
- Record
GHSA-x9jp-4w8m-4f3c- Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVNo score
Cross Site Scripting vulnerability in django-jsonform's admin form.
Description
django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks.
This only affects the admin pages where the django-jsonform is rendered.
Mitigation
Upgrade to django-jsonform version 2.10.1 or later.
For more information
If you have any questions or comments about this advisory:
- Open an issue.
- Email the maintainer at
Bharat Chauhan <tell.bhch@gmail.com>.
- Record
GHSA-x9jp-4w8m-4f3c- Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-jsonformPyPI | before 2.10.1 | 2.10.1 |
django-jsonformPyPI | before 2.10.1, plus listed versions 0.9.01.0.02.0.02.1.02.10.0 Show 10 moreShow less2.2.02.2.12.3.02.4.02.5.02.6.02.7.02.8.02.8.12.9.0 | 2.10.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-x9jp-4w8m-4f3c is a vulnerability with no CVSS score yet in django-jsonform, published June 10, 2022. No source lists public exploit code. Fixed in django-jsonform 2.10.1.