CVE-2021-45116: Django - Information Disclosure in dictsort Template Filter
Summary
CVE-2021-45116: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Affects django across 3 version ranges.
>= 2.2, < 2.2.26
>= 3.2, < 3.2.11
>= 4.0, < 4.0.1
Fixed in 2.2.26, 3.2.11 or 4.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-45116 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and versatility. It provides a powerful template language that allows developers to dynamically generate HTML, XML, and other output formats. The dictsort template filter is used to sort dictionaries based on their keys or values. This filter is susceptible to an information disclosure vulnerability, potentially leading to unintended method calls or exposure of sensitive data.
Vulnerability Detail
The vulnerability in Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 arises from the way the dictsort template filter leverages the Django Template Language's variable resolution logic. If a suitably crafted key is passed to the filter, it can result in information disclosure or unintended method calls. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data or execute arbitrary code.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.262.2.26pip install --upgrade "django==2.2.26" -
>= 3.2, < 3.2.113.2.11pip install --upgrade "django==3.2.11" -
>= 4.0, < 4.0.14.0.1pip install --upgrade "django==4.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can avoid using the dictsort template filter with untrusted or user-controlled input. Instead, it is advisable to perform the necessary sorting operations in the backend code before passing the data to the template. By sanitizing and validating the input data, the risk of exploitation can be significantly reduced. Here's an example of how to perform sorting in Python code:
sorted_data = sorted(data.items())
Conclusion
In conclusion, the CVE-2021-45116 vulnerability in Django's dictsort template filter can lead to information disclosure or unintended method calls. It is crucial to update Django to the patched versions and avoid using the filter with untrusted input. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability can potentially lead to information disclosure or unintended method calls. This could result in unauthorized access to sensitive data or the execution of arbitrary code.
No, only Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 are affected. It is crucial to update to the patched versions to mitigate the risk.
Yes, developers can avoid using the dictsort template filter with untrusted or user-controlled input. Sorting operations can be performed in the backend code before passing the data to the template.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
You can find more information about this vulnerability in the Django advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2022-2.yaml
Related vulnerabilities
Recent vulnerabilities recorded for django.
