DemoBook a demo

Vulnerability advisory

CVE-2024-27351

Published Updated OSV record ↗

Also known as BIT-django-2024-27351GHSA-vm8q-m57g-pff3PYSEC-2024-47

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
3591e1c1acbd7c13174275367c3fdf012cb0413b to before c98eca322af87adf046ab621e7c8a23d340f7afec98eca322af87adf046ab621e7c8a23d340f7afe
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 61a986f53d805e4d359ab61af60a2dcd55befe2561a986f53d805e4d359ab61af60a2dcd55befe25
52821001bb62b764d73e63812133f199b8fef9eb to before 4b64d7285c4aa592c902985b6284ee3afe9045954b64d7285c4aa592c902985b6284ee3afe904595
Not specified072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521
Not specified3394fc6132436eca89e997083bae9985fb7e761e
Not specified3c9a2771cc80821e041b16eb36c1c37af5349d4a

Description

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.