CVE-2024-23341: Django Format Html Bypass
Calling `format_html` with a single dynamic variable or an inplace formatted string (e.g. f-string, `.format()`, `%`) bypasses Django's XSS escaping. `format_html` must be called with a template block as the first argument, followed by variables to automatically safely escape. For example, use `format_html("<tag>{}</tag>", user_input)` instead of `format_htm
Pythongreprules fetch cve-2024-23341-django-format-html-bypass --engine opengrepDescription
Calling `format_html` with a single dynamic variable or an inplace formatted string (e.g. f-string, `.format()`, `%`) bypasses Django's XSS escaping. `format_html` must be called with a template block as the first argument, followed by variables to automatically safely escape. For example, use `format_html("<tag>{}</tag>", user_input)` instead of `format_htm
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0