{"id":"CVE-2020-25626","aliases":["DEBIAN-CVE-2020-25626","DSA-5186-1","EUVD-2020-0073","GHSA-fx83-3ph3-9j2q","PYSEC-2020-263","UBUNTU-CVE-2020-25626","openSUSE-SU-2021:0322-1","openSUSE-SU-2021:0338-1","openSUSE-SU-2024:11227-1","openSUSE-SU-2024:13861-1","openSUSE-SU-2026:11571-1"],"status":"published","title":"Cross-site Scripting (XSS) in Django REST Framework","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01297,"percentile":0.7059,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-79"],"published":"2020-09-30T19:24:45Z","modified":"2026-10-26T12:02:40Z","fixes":[{"ecosystem":"PyPI","package":"djangorestframework","fixed_in":["3.11.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"djangorestframework","fixed_in":["3.12.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"djangorestframework","fixed_in":["3.12.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"djangorestframework","fixed_in":["3.12.1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"python-djangorestframework","fixed_in":["3.11.2-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"python-djangorestframework-test","fixed_in":["3.11.2-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"python-djangorestframework","fixed_in":["3.11.2-bp152.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"python-djangorestframework-test","fixed_in":["3.11.2-bp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-djangorestframework","fixed_in":["3.18.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1+deb10u1"}]}],"versions":["3.9.0-1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2"}]}],"versions":["0.1","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1","3.9.2","3.9.3","3.9.4"]},{"source":"osv","ecosystem":"PyPI","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2"}]}],"versions":["0.1","0.1.1","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","2.0.0","2.0.1","2.0.2","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.14","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1.0","3.1.1","3.1.2","3.1.3","3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.8.0","3.8.1","3.8.2","3.9.0","3.9.1","3.9.2","3.9.3","3.9.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.3-2","3.3.1-1","3.3.2-1","3.3.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-2","3.7.7-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0-2","3.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-1","3.12.4-1","3.12.4-2","3.12.4-2ubuntu1","3.12.4-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.2-2","3.16.0-1","3.16.0-1ubuntu1","3.16.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.1-3","3.16.1-4","3.17.1+ds1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.1-1","3.16.1-3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-djangorestframework-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-djangorestframework-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-djangorestframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"encode","product":"django_rest_framework"},{"vendor":"redhat","product":"ceph_storage"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878635","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5186","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25626","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fx83-3ph3-9j2q","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/djangorestframework/PYSEC-2020-263.yaml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0003","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-25626","tags":["advisory"]},{"url":"https://github.com/encode/django-rest-framework","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-25626","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25626","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R3GZDKNNVOILNHAK6KSWOYM6URRERTB4/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177205","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25626","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7NYNAEPY3UVCIEUTPMQBXFJ42XJG7RVG/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-25626","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T19:24:45Z","modified":"2024-08-04T15:40:35.425Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-0073","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T19:24:45Z","modified":"2024-08-04T15:40:35Z","updated_at":"2026-11-03T03:07:17.317062Z"}],"ghsa":[{"id":"GHSA-fx83-3ph3-9j2q","title":"Cross-site Scripting (XSS) in Django REST Framework","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2021-03-19T21:32:47Z","modified":"2024-09-20T14:56:48Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-79"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2020-25626","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T20:15:15.48Z","modified":"2026-06-17T03:07:00.257Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-79"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-25626","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T20:15:15.48Z","modified":"2026-10-24T10:30:55.921674604Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-25626","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T20:15:15.48Z","modified":"2026-10-26T12:02:40.347489112Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-fx83-3ph3-9j2q","title":"Cross-site Scripting (XSS) in Django REST Framework","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2021-03-19T21:32:47Z","modified":"2024-09-20T15:12:55.35532Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-20","CWE-79"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2020-25626","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T20:15:00Z","modified":"2026-10-17T12:55:52.22435129Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DSA-5186-1","title":"djangorestframework - security update","status":"published","published":"2022-07-22T00:00:00Z","modified":"2026-03-09T02:10:13.995018Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2021:0322-1","title":"Security update for python-djangorestframework","description":"This update for python-djangorestframework fixes the following issues:\n\nUpdate to 3.11.2\n\n* Security: Drop urlize_quoted_links template tag in favour of \n  Django's built-in urlize. Removes a XSS vulnerability for some \n  kinds of content in the browsable API. (boo#1177205, CVE-2020-25626)\n* update Django for APIs book to 3.0 edition\n* decode base64 credentials as utf8; adjust tests\n* Remove compat urls for Django \u003c 2.0\n","status":"published","published":"2021-02-21T22:33:07Z","modified":"2026-02-04T03:50:06.882832Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0338-1","title":"Security update for python-djangorestframework","description":"This update for python-djangorestframework fixes the following issues:\n\nUpdate to 3.11.2\n\n* Security: Drop urlize_quoted_links template tag in favour of \n  Django's built-in urlize. Removes a XSS vulnerability for some \n  kinds of content in the browsable API. (boo#1177205, CVE-2020-25626)\n* update Django for APIs book to 3.0 edition\n* decode base64 credentials as utf8; adjust tests\n* Remove compat urls for Django \u003c 2.0\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-02-25T09:05:18Z","modified":"2026-02-04T03:25:17.395334Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11227-1","title":"python36-djangorestframework-3.12.4-1.2 on GA media","description":"These are all security issues fixed in the python36-djangorestframework-3.12.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:33.460414Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13861-1","title":"python310-djangorestframework-3.15.1-1.1 on GA media","description":"These are all security issues fixed in the python310-djangorestframework-3.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:36.663853Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11571-1","title":"python313-djangorestframework-3.18.0-1.1 on GA media","description":"These are all security issues fixed in the python313-djangorestframework-3.18.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-21T00:00:00Z","modified":"2026-08-22T18:23:36.260221528Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2020-263","description":"A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious \u003cscript\u003e tags, leading to a cross-site-scripting (XSS) vulnerability.","status":"published","published":"2020-09-30T20:15:00Z","modified":"2023-11-08T04:03:10.467693Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}