CVE-2014-3994: Cross-Site Scripting (XSS) Vulnerability in Djblets
Summary
CVE-2014-3994: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or H... Affects djblets across 5 version ranges.
< 0.7.30
>= 0.8, < 0.8.3
< 77a68c03cd619a0996f3f37337b8c39ca6643d6e
< 50000d0bbb983fa8c097b588d06b64df8df483bd
< e2c79117efd925636acd871a5f473512602243cf
Fixed in 0.7.30 or 0.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Djblets is a Python package that provides various utilities and template tags for Django. It is commonly used in Review Board, a web-based code review tool. Djblets allows users to inject arbitrary web script or HTML through a JSON object, specifically in the name field when changing a user name. This vulnerability can be exploited by remote attackers to perform cross-site scripting attacks.
Vulnerability Detail
The vulnerability (CVE-2014-3994) in Djblets allows remote attackers to inject arbitrary web script or HTML through a JSON object. By manipulating the name field when changing a user name, an attacker can execute malicious code on the target user's browser. This can lead to various consequences, such as stealing sensitive information, session hijacking, or defacing the website. The vulnerability affects Djblets versions before 0.7.30 and 0.8.x before 0.8.3 for Django.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "djblets==6.1.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.7.300.7.30pip install --upgrade "djblets==0.7.30" -
>= 0.8, < 0.8.30.8.3pip install --upgrade "djblets==0.8.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Djblets is not immediately feasible, a temporary workaround is to sanitize user input in the affected name field. This can be achieved by implementing input validation and escaping special characters. Here is an example of how to sanitize user input in Django:
import html
name = html.escape(name)
Conclusion
The CVE-2014-3994 vulnerability in Djblets allows remote attackers to perform cross-site scripting attacks by injecting arbitrary web script or HTML. It is crucial to upgrade Djblets to the fixed versions (0.7.30 or 0.8.3) or implement input validation and sanitization in the affected name field. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for djblets →
FAQ
Djblets is a Python package that provides utilities and template tags for Django. It is commonly used in Review Board, a web-based code review tool.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various consequences, such as stealing sensitive information or performing unauthorized actions on behalf of the user.
This vulnerability allows remote attackers to inject arbitrary web script or HTML through a JSON object in Djblets. By manipulating the name field when changing a user name, an attacker can execute malicious code on the target user's browser.
The consequences of this vulnerability include the ability for attackers to steal sensitive information, perform session hijacking, or deface the website.
To fix this vulnerability, it is recommended to upgrade Djblets to version 0.7.30 or 0.8.3, depending on the installed version. This can be done by running the command 'pip install --upgrade djblets==0.7.30' (or 0.8.3).
References
Related vulnerabilities
Recent vulnerabilities recorded for djblets.
