Arch Linux Security Advisory ASA-201607-10 ========================================== Severity: Medium Date : 2016-07-22 CVE-ID : CVE-2016-6186 Package : python-django Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.8-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "python-django>=1.9.8-1" The problem has been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== Unsafe usage of JavaScript's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn't identified there, out of an abundance of caution it's also updated to use textContent. Impact ====== An attacker is able to execute arbitrary javascript code in the client's browser by inserting code in the admin's add/change related popup. References ========== https://www.djangoproject.com/weblog/2016/jul/18/security-releases/ http://article.gmane.org/gmane.comp.python.django.announce/54 https://access.redhat.com/security/cve/CVE-2016-6186