CVE-2008-2302: Cross-Site Scripting (XSS) Vulnerability in Django
Summary
CVE-2008-2302: Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script... Affects django versions < 1.1. Fixed in 1.1. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2008-2302 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a high-level development environment and follows the Model-View-Controller (MVC) architectural pattern. The vulnerability affects Django versions 0.91 to 0.91.2, 0.95 to 0.95.3, and 0.96 to 0.96.2. This vulnerability allows remote attackers to inject arbitrary web script or HTML through the URI of a specific previous request.
Vulnerability Detail
The vulnerability in Django's administration application login form allows attackers to perform cross-site scripting (XSS) attacks. By injecting malicious web script or HTML code through the URI of a previous request, an attacker can execute arbitrary code within the context of the affected user's browser. This can lead to various security issues, such as session hijacking, data theft, or unauthorized actions on behalf of the user.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1
This is the first release that contains the fix.
pip install --upgrade "django==1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by manually sanitizing and encoding user input before displaying it in the application. This can be achieved by using appropriate functions or libraries provided by the programming language or framework being used. It is crucial to thoroughly validate and sanitize all user-supplied data to prevent XSS attacks.
Conclusion
The cross-site scripting (XSS) vulnerability in Django's administration application login form can allow remote attackers to execute arbitrary code within the context of a user's browser. To mitigate this vulnerability, it is recommended to upgrade Django to version 1.1 or later. If immediate upgrade is not possible, implementing proper input sanitization and output encoding techniques can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the victim's browser, potentially compromising their sensitive information or performing unauthorized actions.
An attacker can exploit this vulnerability by crafting a malicious URI and tricking a user with administrative privileges to click on it. When the user visits the manipulated URI, the injected script or HTML code will be executed within their browser, allowing the attacker to perform various malicious actions.
No, only Django versions 0.91 to 0.91.2, 0.95 to 0.95.3, and 0.96 to 0.96.2 are affected. It is recommended to upgrade to version 1.1 or later to mitigate this vulnerability.
There is no specific information available regarding known exploits targeting this vulnerability. However, it is always advisable to promptly address security vulnerabilities to minimize the risk of exploitation.
You can find more information about this vulnerability, including technical details and the fix, in the official Django advisory: https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2008-1.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
