---
id: CVE-2018-25045
aliases:
  - GHSA-xqcf-hj92-967m
  - PYSEC-2026-804
title: Django REST framework XSS Vulnerability
summary: Django REST framework XSS Vulnerability
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: django-rest-framework
product: django-rest-framework
ecosystem: pip
affected:
  - django-rest-framework < 3.9.1
patched:
  - django-rest-framework 3.9.1
published: '2022-07-24'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-xqcf-hj92-967m'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-25045'
  - url: 'https://github.com/encode/django-rest-framework/pull/6191'
  - url: 'https://github.com/encode/django-rest-framework/pull/6330'
  - url: >-
      https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8
  - url: 'https://github.com/encode/django-rest-framework'
tags:
  - osv
  - pip
epss: 0.00757
epssPercentile: 0.53685
ingestedAt: '2026-07-08T18:25:54.628Z'
---

## Overview

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.

## Affected packages

- `django-rest-framework < 3.9.1`

## Remediation

Upgrade to a patched release:

- `django-rest-framework 3.9.1`