CVE-2017-7233: Open Redirect Vulnerability in Django
Summary
CVE-2017-7233: Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. Affects django across 3 version ranges.
>= 1.8, < 1.8.18
>= 1.9, < 1.9.13
>= 1.10, < 1.10.7
Fixed in 1.8.18, 1.9.13 or 1.10.7, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2017-7233 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It offers features such as URL routing, template rendering, and database management. Django versions 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 are affected by an open redirect vulnerability.
Vulnerability Detail
The open redirect vulnerability in Django arises from the reliance on user input to redirect the user to an 'on success' URL. The security check for these redirects, specifically the 'django.utils.http.is_safe_url()' function, incorrectly considers some numeric URLs as 'safe' when they should not be. This vulnerability can be exploited to perform open redirects or even launch cross-site scripting (XSS) attacks if a developer uses 'is_safe_url()' to generate links.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.8, < 1.8.181.8.18pip install --upgrade "django==1.8.18" -
>= 1.9, < 1.9.131.9.13pip install --upgrade "django==1.9.13" -
>= 1.10, < 1.10.71.10.7pip install --upgrade "django==1.10.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can manually validate and sanitize user input before using it in redirect URLs to mitigate the risk of open redirects or XSS attacks.
Conclusion
The open redirect vulnerability in Django versions 1.10, 1.9, and 1.8 can lead to security risks such as open redirects and XSS attacks. It is crucial to upgrade to the fixed versions and review code to avoid using the vulnerable 'is_safe_url()' function. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for django →
FAQ
An open redirect vulnerability occurs when a web application allows user-controlled input to be used in redirect URLs without proper validation. Attackers can exploit this vulnerability to redirect users to malicious websites.
Cross-site scripting (XSS) is a type of security vulnerability where attackers inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Pipfile.lock file.
While there may not be a specific known exploit for this vulnerability, it is important to address it promptly to prevent potential security risks. Upgrading Django and following secure coding practices can help mitigate the risk.
You can find more information about this vulnerability in the Django advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2017-9.yaml.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
