CVE-2019-12308: Django - Clickable Current URL Value Vulnerability
Summary
CVE-2019-12308: An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. Affects django across 3 version ranges.
>= 1.11, < 1.11.21
>= 2.1, < 2.1.9
>= 2.2, < 2.2.2
Fixed in 1.11.21, 2.1.9 or 2.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- py-django · Alpine:v3.10
The same CVE-2019-12308 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a robust set of tools and features for building web applications. The vulnerability in question affects Django versions 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. Django's AdminURLFieldWidget, used in the admin interface, displays the provided URL value without proper validation. This can lead to the execution of arbitrary JavaScript code if an unvalidated value is stored in the database or provided as a URL query parameter payload.
Vulnerability Detail
The vulnerability arises from the lack of validation of the Current URL value displayed by the AdminURLFieldWidget in Django's admin interface. This allows an attacker to inject malicious JavaScript code by storing an unvalidated value in the database or by providing a specially crafted URL query parameter payload. When the user interacts with the vulnerable field, the injected JavaScript code can be executed, potentially leading to various security risks such as cross-site scripting (XSS) attacks.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.11, < 1.11.211.11.21pip install --upgrade "django==1.11.21" -
>= 2.1, < 2.1.92.1.9pip install --upgrade "django==2.1.9" -
>= 2.2, < 2.2.22.2.2pip install --upgrade "django==2.2.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to manually validate and sanitize any URL values before storing them in the database or using them as query parameters. This can be achieved by implementing custom validation logic in the application code. For example, using Django's built-in URLValidator to validate and sanitize URL inputs can help mitigate the risk of this vulnerability. Here's an example of how to use URLValidator in Django:
from django.core.validators import URLValidator from django.core.exceptions import ValidationError
url_validator = URLValidator()
try: url_validator('http://example.com') except ValidationError as e: # Handle the validation error pass
Conclusion
In conclusion, the Clickable Current URL Value vulnerability in Django's AdminURLFieldWidget can allow an attacker to execute arbitrary JavaScript code. To mitigate this risk, it is crucial to upgrade Django to the fixed versions and implement proper validation and sanitization of URL inputs. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django versions 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2 are affected by this vulnerability.
This vulnerability can allow an attacker to execute arbitrary JavaScript code, potentially leading to cross-site scripting (XSS) attacks and other security risks.
To fix this vulnerability, it is recommended to upgrade Django to version 1.11.21, 2.1.9, or 2.2.2, depending on the version being used.
As a temporary workaround, you can manually validate and sanitize URL values before storing them or using them as query parameters.
You can find more information about this vulnerability in the official Django security advisory: https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2019-79.yaml
Related vulnerabilities
Recent vulnerabilities recorded for django.
