DemoBook a demo

Vulnerability advisory

CVE-2019-12308

Published Updated OSV record ↗

Also known as GHSA-7rp2-fm2h-wchjPYSEC-2019-79

Severity
  • CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
c669cf279ae7b3e02a61db4fb077030a4db80e4f to before bc1f79d0a01d085500aa82ff29800403291a91a4bc1f79d0a01d085500aa82ff29800403291a91a4
df591468251ed489a3e147d7c359f387f4effe66 to before 60ebd195c99884e0cf0aee721839119079bb304660ebd195c99884e0cf0aee721839119079bb3046
2a62cdcfec85938f40abb2e9e6a9ff497e02afe8 to before 9400c96b209855d7b97e3223e4b8ba7751c357cc9400c96b209855d7b97e3223e4b8ba7751c357cc

Description

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.