Djangorestframework vulnerable to Cross-site Scripting (XSS) via break_long_headers template filter

CVE-2024-21520

What is CVE-2024-21520?

A security vulnerability exists in the Django REST Framework where improper input sanitization can lead to cross-site scripting (XSS) attacks through the break_long_headers template filter. This flaw allows attackers to inject malicious scripts, potentially compromising user data and sessions. The vulnerability is present in all versions prior to 3.15.2, making it essential for users to upgrade to the latest version to mitigate the risk. By failing to adequately sanitize inputs prior to processing, affected systems may exhibit unexpected behavior, enabling exploitation by malicious entities.

References