NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

Django cross-site scripting (XSS) vulnerability via is_safe_url functionGHSA-9cwg-mhxf-hh59

MEDIUMFix: django/django@1a274cc

GHSA-9cwg-mhxf-hh59 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in django. A fix is available for django — see the affected versions and patch details below.

Also known asCVE-2013-6044PYSEC-2013-21
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
2.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs83th percentile — riskier than 83% of all scored CVEsHighest risk
1.75%2.72%3.70%4.67%4.1%2.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
🐍django🐍django

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIdjango≥ 1.4&&< 1.4.61.4.6pip install --upgrade 'django==1.4.6'
🐍PyPIdjango≥ 1.5&&< 1.5.21.5.2pip install --upgrade 'django==1.5.2'

Affected Products

1 product · 8 configurations
Application
djangodjangoproject
8 versions
1.41.4.11.4.21.4.41.4.51.51.5.11.6

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for django, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update django to 1.4.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9cwg-mhxf-hh59 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate
ProductFixed inAdvisory
OpenStack 3 for RHEL 6Django14-0:1.4.8-1.el6ostRHSA-2013:1521

Frequently Asked Questions

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.
O3 Security · Impact-Aware SCA

Is GHSA-9cwg-mhxf-hh59 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
Django cross-site scripting (XSS) vulnerability via…