{"id":"GHSA-x9jp-4w8m-4f3c","aliases":[],"status":"published","title":"Cross Site Scripting vulnerability in django-jsonform's admin form.","description":"### Description\n\ndjango-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks.\n\nThis only affects the admin pages where the django-jsonform is rendered.\n\n### Mitigation\n\nUpgrade to django-jsonform version 2.10.1 or later.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/bhch/django-jsonform/issues).\n* Email the maintainer at `Bharat Chauhan \u003ctell.bhch@gmail.com\u003e`.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-80"],"published":"2022-06-10T19:51:18Z","modified":"2024-12-07T05:41:09Z","fixes":[{"ecosystem":"PyPI","package":"django-jsonform","fixed_in":["2.10.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django-jsonform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django-jsonform","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1"}]}],"versions":["0.9.0","1.0.0","2.0.0","2.1.0","2.10.0","2.2.0","2.2.1","2.3.0","2.4.0","2.5.0","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0"]}],"references":[{"url":"https://github.com/bhch/django-jsonform/security/advisories/GHSA-x9jp-4w8m-4f3c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9jp-4w8m-4f3c"},{"url":"https://github.com/bhch/django-jsonform","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-x9jp-4w8m-4f3c","title":"Cross Site Scripting vulnerability in django-jsonform's admin form.","description":"### Description\n\ndjango-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks.\n\nThis only affects the admin pages where the django-jsonform is rendered.\n\n### Mitigation\n\nUpgrade to django-jsonform version 2.10.1 or later.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/bhch/django-jsonform/issues).\n* Email the maintainer at `Bharat Chauhan \u003ctell.bhch@gmail.com\u003e`.\n","status":"published","published":"2022-06-10T19:51:18Z","modified":"2023-01-12T05:00:39Z","cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-x9jp-4w8m-4f3c","title":"Cross Site Scripting vulnerability in django-jsonform's admin form.","description":"### Description\n\ndjango-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks.\n\nThis only affects the admin pages where the django-jsonform is rendered.\n\n### Mitigation\n\nUpgrade to django-jsonform version 2.10.1 or later.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/bhch/django-jsonform/issues).\n* Email the maintainer at `Bharat Chauhan \u003ctell.bhch@gmail.com\u003e`.\n","status":"published","published":"2022-06-10T19:51:18Z","modified":"2024-12-07T05:41:09.009182Z","cwes":["CWE-79","CWE-80"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}