CVE-2020-13596: Django - Improper URL Encoding in ForeignKeyRawIdWidget
Summary
CVE-2020-13596: An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Affects django across 2 version ranges.
>= 2.2, < 2.2.13
>= 3.0, < 3.0.7
Fixed in 2.2.13 or 3.0.7, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2020-13596 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a robust set of tools and features for building web applications. The ForeignKeyRawIdWidget is a widget used in the Django admin interface to display foreign key fields as raw input fields. This widget allows users to enter the ID of the related object directly. However, prior to versions 2.2.13 and 3.0.7, the query parameters generated by the ForeignKeyRawIdWidget were not properly URL encoded, which could lead to a potential cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Django versions before 2.2.13 and 3.0.7 arises from the improper URL encoding of query parameters in the ForeignKeyRawIdWidget. This allows an attacker to inject malicious code into the generated URL, potentially leading to an XSS attack. By exploiting this vulnerability, an attacker could execute arbitrary JavaScript code in the context of an authenticated Django admin user, potentially compromising the confidentiality and integrity of the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.132.2.13pip install --upgrade "django==2.2.13" -
>= 3.0, < 3.0.73.0.7pip install --upgrade "django==3.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually URL encoding the query parameters in the affected code. This can be achieved using the 'urllib.parse' module in Python. Here's an example of how to URL encode the query parameters:
import urllib.parse
url = 'https://example.com/?param=' + urllib.parse.quote_plus(user_input)
By properly URL encoding the query parameters, the vulnerability can be mitigated.
Conclusion
The vulnerability in Django versions before 2.2.13 and 3.0.7 allows for potential XSS attacks due to improper URL encoding in the ForeignKeyRawIdWidget. To mitigate this vulnerability, it is recommended to upgrade Django to the latest patched version. If immediate upgrade is not possible, manually URL encoding the query parameters can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of an authenticated Django admin user. This can lead to various consequences, including data theft, session hijacking, and unauthorized actions within the application.
No, only Django versions before 2.2.13 and 3.0.7 are affected. It is recommended to upgrade to the latest patched version to ensure the vulnerability is addressed.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the necessary patches or upgrades to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious URL and trick an authenticated Django admin user into clicking it, leading to the execution of arbitrary JavaScript code.
As of now, there is no publicly available CVSS score for this vulnerability. It is advisable to stay updated with the latest security advisories and vulnerability databases for any future updates.
Related vulnerabilities
Recent vulnerabilities recorded for django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
