DemoBook a demo

Vulnerability advisory

CVE-2018-7536

Published Updated OSV record ↗

Also known as GHSA-r28v-mw67-m5p9PYSEC-2018-5

Severity
  • CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
6a0dc2176f4ebf907e124d433411e52bba39a28e to before c686dd8e6bb3817bcf04b8f13c025b4d3c3dc6dcc686dd8e6bb3817bcf04b8f13c025b4d3c3dc6dc
c669cf279ae7b3e02a61db4fb077030a4db80e4f to before 1cc5aceac0a73468a6d1a671b9c86423e5bcf0111cc5aceac0a73468a6d1a671b9c86423e5bcf011
8c85c8692240e5ae4b568eb4272475fe1fa4b059 to before 2d73ffc6f96e399716a1ed3f58acd4e99afa3d332d73ffc6f96e399716a1ed3f58acd4e99afa3d33
Not specified1ca63a66ef3163149ad822701273e8a1844192c2
Not specifiedabf89d729f210c692a50e0ad3f75fb6bec6fae16
Not specifiede157315da3ae7005fa0683ffc9751dbeca7306c8

Description

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.