CVE catalog
CVE-2020-25626
djangorestframework: CVE-2020-25626
- Severity
- High · CVSS 7.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.30% · Oct 25, 2026
A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | djangorestframework | sid | 3.18.3+ds1-1 | fixed |
| Debian | djangorestframework | forky | 3.18.3+ds1-1 | fixed |
| Debian | djangorestframework | trixie | 3.16.0-1 | fixed |
| Debian | djangorestframework | bookworm | 3.14.0-2+deb12u1 | fixed |
| Opensuse | python-djangorestframework | tumbleweed | 3.18.0-1.1 | fixed |
| Opensuse | python-djangorestframework | leap 15.2 | 3.11.2-lp152.2.3.1 | fixed |
| Opensuse | python-djangorestframework-test | leap 15.2 | 3.11.2-lp152.2.3.1 | fixed |
| Suse | python-djangorestframework | package hub 15 sp2 | 3.11.2-bp152.2.3.1 | fixed |
| Suse | python-djangorestframework-test | package hub 15 sp2 | 3.11.2-bp152.2.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | djangorestframework | source | sid | 3.12.1-1 | not yet assigned | Not reported | [971554] |
| Debian | djangorestframework | source | forky | 3.12.1-1 | not yet assigned | Not reported | [971554] |
| Debian | djangorestframework | source | trixie | 3.12.1-1 | not yet assigned | Not reported | [971554] |
| Debian | djangorestframework | source | bookworm | 3.12.1-1 | not yet assigned | Not reported | [971554] |
| Opensuse | python-djangorestframework | rpm | tumbleweed | 3.18.0-1.1 | Not reported | OPENSUSE-SU-2026:11571-1 | Not reported |
| Opensuse | python-djangorestframework | rpm | leap 15.2 | 3.11.2-lp152.2.3.1 | Not reported | OPENSUSE-SU-2021:0322-1 | Not reported |
| Opensuse | python-djangorestframework-test | rpm | leap 15.2 | 3.11.2-lp152.2.3.1 | Not reported | OPENSUSE-SU-2021:0322-1 | Not reported |
| Suse | python-djangorestframework | rpm | package hub 15 sp2 | 3.11.2-bp152.2.3.1 | Not reported | OPENSUSE-SU-2021:0338-1 | Not reported |
| Suse | python-djangorestframework-test | rpm | package hub 15 sp2 | 3.11.2-bp152.2.3.1 | Not reported | OPENSUSE-SU-2021:0338-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [python313-djangorestframework]Unknown
Source package: [python-djangorestframework]
Details (1)
3.18.0-2.1· noarch · tumbleweedUnknown · Fixed:
3.18.0-1.1Version impact unknown
dsa · python-djangorestframework · opensuse · tumbleweed
- [python314-djangorestframework]Unknown
Source package: [python-djangorestframework]
Details (1)
3.18.0-2.1· noarch · tumbleweedUnknown · Fixed:
3.18.0-1.1Version impact unknown
dsa · python-djangorestframework · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [python3-djangorestframework]Fixed
Source package: [djangorestframework]
Details (2)
3.14.0-2+deb12u1· all · bookwormFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · bookworm; dsa · djangorestframework · debian · 12
3.14.0-2+deb12u1· all · bookwormFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · bookworm; dsa · djangorestframework · debian · 12
Source package: [djangorestframework]
Details (2)
3.14.0-2+deb12u1· all · bookwormFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · bookworm; dsa · djangorestframework · debian · 12
3.14.0-2+deb12u1· all · bookwormFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · bookworm; dsa · djangorestframework · debian · 12
[Debian 13 (Trixie)]
- [python3-djangorestframework]Fixed
Source package: [djangorestframework]
Details (2)
3.16.0-1· all · trixieFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · 13
3.16.0-1· all · trixieFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · 13
Source package: [djangorestframework]
Details (2)
3.16.0-1· all · trixieFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · 13
3.16.0-1· all · trixieFixed · Fixed:
3.12.1-1dsa · djangorestframework · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11571-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-25626]
- [https://osv.dev/vulnerability/openSUSE-SU-2021:0322-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2021:0338-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11571-1]
- [https://security-tracker.debian.org/tracker/CVE-2020-25626]
- [https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-25626.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]