An open index of dependabot pull requests across open source projects.

Django Improper Output Neutralization for Logs vulnerability

RSS Feed MODERATE
GHSA-7xr5-9hcq-chf9 CVE-2025-48432
Description:

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Affected Packages
Ecosystem Package Vulnerable Versions Patched Version
pypi Django < 4.2.22
>= 5.0a1, < 5.1.10
>= 5.2, < 5.2.2
4.2.22
Related Dependabot Pull Requests
Bump django from 3.2.18 to 4.2.24 in /web
Open about 1 year ago
icbi-lab/mio #11
pip:django
icbi-lab
Bump django from 4.2.16 to 4.2.24
Open about 1 year ago
ferdle-org/dependabot-python-test #5
pip:django
ferdle-org
Bump django from 4.1.13 to 4.2.24
Closed about 1 year ago
Jawwad-Fida/HealthStack-System #524
pip:django
Jawwad-Fida
build(deps): Bump django from 4.2.23 to 4.2.24 in /backend
Closed about 1 year ago
Bryvn01/EasyCart #45
pip:django
Bryvn01
Bump django from 4.2.23 to 4.2.24
Open about 1 year ago
daveisfera/celery_cold_shutdown #20
pip:django
daveisfera
Bump django from 4.2.14 to 4.2.24
Merged about 1 year ago
luismdp05/sistema-gestion-academica #5
pip:django
luismdp05
Bump django from 4.2.22 to 4.2.24 in /ML-Models/Heart-Disease-Classification
Open about 1 year ago
avinashkranjan/lifeMEDeasy #952
pip:django
avinashkranjan
Bump django from 4.2.16 to 4.2.24
Closed about 1 year ago
alff0x1f/kolco24 #108
pip:django
alff0x1f
Bump django from 4.2.23 to 4.2.24
Open about 1 year ago
Open-Source-Legal/OpenContracts #484
pip:django
Open-Source-Legal
Bump django from 2.0.5 to 4.2.24
Closed about 1 year ago
mark-graciov/battleship #2
pip:django
mark-graciov
Bump django from 3.2.25 to 4.2.24
Open about 1 year ago
CVEDB/reconPoint #13
pip:django
CVEDB
Bump django from 2.2.6 to 4.2.24
Open about 1 year ago
creamsandwch/hw03_forms #2
pip:django
creamsandwch
Bump django from 2.2.19 to 4.2.24 in /yatube
Merged about 1 year ago
creamsandwch/hw02_community #1
pip:django
creamsandwch
Bump django from 2.2.19 to 4.2.24 in /yatube
Merged about 1 year ago
creamsandwch/hw03_forms #1
pip:django
creamsandwch
Bump django from 5.1.9 to 5.1.12
Merged about 1 year ago
EdinsonRequena/tiktok-backend-clone #26
pip:django
EdinsonRequena
Bump django from 4.2.8 to 4.2.24
Closed about 1 year ago
21toffy/newsapi #11
pip:django
21toffy
Bump django from 3.2.25 to 4.2.24
Open about 1 year ago
zaymuel/project-manager #21
pip:django
zaymuel
Bump django from 4.2.22 to 4.2.24 in /api_yamdb
Merged about 1 year ago
themasterid/infra_sp2 #14
pip:django
themasterid
Bump the all-python-dependencies group across 1 directory with 9 updates
Closed about 1 year ago
jaydonkrooss/my-learning-analytics #14
pip:pandas pip:django +7 more
jaydonkrooss
build(deps): bump django from 4.2.3 to 4.2.24
Open about 1 year ago
alisson-vml/crud_django_pokedex #1
pip:django
alisson-vml
Bump django from 5.0.14 to 5.1.12 in /backend
Merged about 1 year ago
aayushker/Shhh #18
pip:django
aayushker
Bump the all-python-dependencies group across 1 directory with 9 updates
Open about 1 year ago
tl-its-umich-edu/my-learning-analytics #1677
pip:pandas pip:django +7 more
tl-its-umich-edu
Bump django from 5.0.6 to 5.1.12
Open about 1 year ago
Fahimun/ready #1
pip:django
Fahimun
Bump django from 5.1.2 to 5.1.12 in /projects/gcom-2025
Open about 1 year ago
ubc-uas/gcom #5
pip:django
ubc-uas
Bump django from 4.0.2 to 4.2.24
Closed about 1 year ago
TheGhostAlmas/form_clone #7
pip:django
TheGhostAlmas
Bump django from 3.2.25 to 4.2.24
Merged about 1 year ago
vankhaiphan/vietnamdonationfoundation #14
pip:django
vankhaiphan
chore(deps): bump the dependencies group across 3 directories with 26 updates
Open about 1 year ago
amanning3390/PSI-Inventory #12
pip:mkdocs-material pip:mkdocstrings +4 more
amanning3390
chore(deps): bump the dependencies group across 3 directories with 19 updates
Closed about 1 year ago
sahil-vakte/inventory-management-system #7
pip:django pip:coverage +12 more
sahil-vakte
deps: bump django from 2.2.28 to 4.2.24
Open about 1 year ago
BuildingSync/BuildingSync-website #201
pip:django
BuildingSync
chore(deps): bump the dependencies group across 3 directories with 19 updates
Open about 1 year ago
Themoffyn/InvenTree-personal #10
pip:django pip:coverage +12 more
Themoffyn
Bump django from 5.1.3 to 5.1.12 in /birds_nest
Closed about 1 year ago
eclipse-efbt/efbt #1712
pip:django
eclipse-efbt
Bump the python-packages group across 1 directory with 21 updates
Open about 1 year ago
nycnoise/nycnoise #563
pip:mypy pip:boto3 +19 more
nycnoise
chore(deps): bump the dependencies group across 3 directories with 19 updates
Open about 1 year ago
galinagl0/inventree #9
pip:django pip:coverage +12 more
galinagl0
chore(deps): bump the dependencies group across 3 directories with 19 updates
Closed about 1 year ago
VictorReOr/inventario-deportivo #9
pip:django pip:coverage +12 more
VictorReOr
chore(deps): bump the python-minor-patch group across 2 directories with 7 updates
Open about 1 year ago
nordic-institute/X-Road-Metrics #191
pip:setuptools pip:django +5 more
nordic-institute
Bump django from 4.2.10 to 4.2.24 in /InformationService
Open about 1 year ago
loraAbramchuk/DiplomTeachMeSkills #1
pip:django
loraAbramchuk
Bump django from 4.2.22 to 4.2.24 in /Python/Django/app
Open about 1 year ago
AngeloRafael02/Self_Archives #229
pip:django
AngeloRafael02
Bump django from 4.2.23 to 4.2.24
Merged about 1 year ago
baseplate-admin/django-hstore-widget #309
pip:django
baseplate-admin
Chore(deps): Bump django from 4.0.10 to 4.2.24 in /etc
Closed about 1 year ago
icann/lgr-django #60
pip:django
icann
Bump the dependencies group across 1 directory with 23 updates
Open about 1 year ago
djangonaut-space/wagtail-indymeet #491
pip:django pip:pytest-mock +21 more
djangonaut-space
Bump django from 4.2.22 to 4.2.24 in /backend
Open about 1 year ago
Zorik28/foodgram-project-react #48
pip:django
Zorik28
Bump django from 4.2.22 to 4.2.24
Merged about 1 year ago
Zorik28/hw05_final #11
pip:django
Zorik28
Bump django from 4.1.13 to 4.2.24
Merged about 1 year ago
John-Howard/ssri #8
pip:django
John-Howard
Bump django from 4.2.20 to 4.2.24 in /backend
Open about 1 year ago
Oslo-kommune-Utdanningsetaten/mestring #42
pip:django
Oslo-kommune-Utdanningsetaten
Bump django from 3.2.25 to 4.2.24
Open about 1 year ago
ElenaVasilkova/infra_sprint1 #3
pip:django
ElenaVasilkova
Bump the python-packages group across 1 directory with 20 updates
Open about 1 year ago
nycnoise/nycnoise #562
pip:mypy pip:boto3 +18 more
nycnoise
Bump django from 3.1.2 to 4.2.24 in /dostavka_info
Open about 1 year ago
yougottman/25_12_2019 #46
pip:django
yougottman
Bump django from 5.1.9 to 5.1.12
Merged about 1 year ago
kevoreilly/CAPEv2 #2708
pip:django
kevoreilly
Bump django from 4.2.17 to 4.2.24
Open about 1 year ago
kaviarasanmani/Tech_connect #12
pip:django
kaviarasanmani
Bump django from 4.2.22 to 4.2.24
Open about 1 year ago
yassine-youcefi/Quiz #41
pip:django
yassine-youcefi
Advisory Details
Published: June 05, 2025 over 1 year ago
Updated: October 08, 2026 about 21 hours ago
CVSS Score: 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS: 0.75% 54th percentile
Source: Github
Classification: GENERAL
UUID: GSA_kwCzR0hTQS03eHI1LTloY3EtY2hmOc4ABIp6
PR Statistics
PR Status
Open 1953 (45.6%)
Merged 868 (20.3%)
Closed 1460 (34.1%)
Update Types
Major 1228 (13.1%)
Minor 3313 (35.4%)
Patch 4167 (44.5%)