CVE-2012-3442: Cross-Site Scripting (XSS) in django
Summary
CVE-2012-3442: The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote a... Affects django across 2 version ranges.
< 1.3.2
>= 1.4, < 1.4.1
Fixed in 1.3.2 or 1.4.1, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2012-3442 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework used for building web applications. It provides a set of tools and libraries for handling common web development tasks. The vulnerability in question affects versions of Django before 1.3.2 and 1.4.x before 1.4.1. Django's HttpResponseRedirect and HttpResponsePermanentRedirect classes do not properly validate the scheme of a redirect target, making them susceptible to cross-site scripting (XSS) attacks via a data: URL.
Vulnerability Detail
The vulnerability arises due to the lack of scheme validation in the mentioned Django classes. This allows an attacker to craft a malicious URL with a data: scheme, which can execute arbitrary JavaScript code in the context of the victim's browser. This type of attack can lead to various consequences, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.21.3.2pip install --upgrade "django==1.3.2" -
>= 1.4, < 1.4.11.4.1pip install --upgrade "django==1.4.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to manually validate the scheme of the redirect target before using the HttpResponseRedirect or HttpResponsePermanentRedirect classes. This can be done by checking the scheme of the URL and ensuring it is a valid scheme (e.g., http or https). Here's an example of how to implement this workaround in Django:
from django.http import HttpResponseRedirect
def safe_redirect(redirect_url):
if redirect_url.startswith('http://') or redirect_url.startswith('https://'):
return HttpResponseRedirect(redirect_url)
else:
# Handle invalid redirect URL
...
Conclusion
The vulnerability in Django versions before 1.3.2 and 1.4.x before 1.4.1 allows for cross-site scripting attacks via data: URLs. It is crucial to upgrade Django to the recommended versions or apply the provided workaround to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the victim's browser, potentially leading to sensitive information theft, session hijacking, or unauthorized actions.
Versions of Django before 1.3.2 and 1.4.x before 1.4.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for potential vulnerabilities.
Yes, upgrading Django to version 1.3.2 or later (for Django 1.3.x) or version 1.4.1 or later (for Django 1.4.x) will fix this vulnerability.
If immediate upgrading is not possible, you can implement a workaround by manually validating the scheme of the redirect target before using the affected Django classes. See the 'workaround' section for more details.
Related vulnerabilities
Recent vulnerabilities recorded for django.
