DemoBook a demo

Vulnerability advisory

CVE-2024-53907

Published Updated OSV record ↗

Also known as BIT-django-2024-53907GHSA-8498-2h75-472jPYSEC-2024-156

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 1f0356ff2af11a5fa71fb07b4627e10edd1704381f0356ff2af11a5fa71fb07b4627e10edd170438
52821001bb62b764d73e63812133f199b8fef9eb to before 3b3a5f4efbf93692557b7f473519bd0ad8f04c6a3b3a5f4efbf93692557b7f473519bd0ad8f04c6a
84d09a547fe35e10018ab242602ca76c29ca91a1 to before 2d4add11fd57b05f7ea48e8b3e89e743c9871aa32d4add11fd57b05f7ea48e8b3e89e743c9871aa3

Description

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.