DemoBook a demo

Vulnerability advisory

CVE-2021-45116

Published Updated OSV record ↗

Also known as BIT-django-2021-45116GHSA-8c5j-9r9f-c6w8PYSEC-2022-2

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
2a62cdcfec85938f40abb2e9e6a9ff497e02afe8 to before 44e7cca62382f2535ed0f5d2842b433f0bd23a5744e7cca62382f2535ed0f5d2842b433f0bd23a57
3591e1c1acbd7c13174275367c3fdf012cb0413b to before 6e499a28ac6ec10c2f0f77b92cab49fb8f8df4196e499a28ac6ec10c2f0f77b92cab49fb8f8df419
ef62a3a68c9d558486145a42c0d71ea9a76add9e to before 27a64da8213f27787ae1c48041a70f197cdcfd6f27a64da8213f27787ae1c48041a70f197cdcfd6f

Description

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.