CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-25626
Medium (6.1). EPSS 1.3% chance of exploitation in the next 30 days. Fixed in djangorestframework 3.11.2.
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- encode:django_rest_framework
- redhat:ceph_storage
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fx83-3ph3-9j2q | PyPI | djangorestframework | <3.11.2 | 3.11.2 |
| PYSEC-2020-263 | PyPI | djangorestframework | <3.11.2 | 3.11.2 |