CVE-2017-12794: Cross-Site Scripting Vulnerability in Django
Summary
CVE-2017-12794: In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Affects django across 2 version ranges.
>= 1.10, < 1.10.8
>= 1.11, < 1.11.5
Fixed in 1.10.8 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2017-12794 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes a template system for generating HTML dynamically. This vulnerability affects Django versions 1.10.x before 1.10.8 and 1.11.x before 1.11.5. The vulnerability arises from the disabling of HTML autoescaping in a portion of the template for the technical 500 debug page. While this vulnerability should not impact most production sites, as they should not have 'DEBUG = True' enabled, it can be exploited in certain circumstances to launch a cross-site scripting attack.
Vulnerability Detail
The vulnerability in Django allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. By injecting malicious code into the debug page, an attacker can potentially steal sensitive information, perform actions on behalf of the user, or manipulate the appearance and behavior of the web application. This vulnerability can be particularly dangerous if the debug page is accessible to unauthorized users or if it contains sensitive information. It is important to note that this vulnerability requires the 'DEBUG' setting to be enabled, which should not be the case in a production environment.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.10, < 1.10.81.10.8pip install --upgrade "django==1.10.8" -
>= 1.11, < 1.11.51.11.5pip install --upgrade "django==1.11.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if upgrading Django is not immediately feasible, it is recommended to ensure that the 'DEBUG' setting is disabled in the production environment. This can be done by setting 'DEBUG = False' in the project's settings file. Additionally, it is important to restrict access to the debug page and ensure that it is not accessible to unauthorized users.
Conclusion
The CVE-2017-12794 vulnerability in Django exposes a potential cross-site scripting attack vector in the debug page template. It is crucial to upgrade Django to the patched versions or disable the 'DEBUG' setting in the production environment to mitigate the risk. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your Django application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the development of web applications by providing a high-level API and a set of tools and libraries.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the victim's browser.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
No, this vulnerability is not critical for all Django applications. It primarily affects applications that have the 'DEBUG' setting enabled in their production environment and expose the debug page to unauthorized users.
While there are no known public exploits for this vulnerability, it is still important to apply the recommended fixes and take necessary precautions to protect your Django application.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
