Low, CVSS 1.7PyPIAmendedPublished
Django TomSelect incomplete escaping of dangerous characters in widget attributes
GHSA-785h-76cm-cpmf
- Affected
- PyPI django-tomselect < 2025.3.3
- Fixed in
- 2025.3.3· Vendor fix available
- Issue
- User supplied values passed through to certain attributes in form widgets are not fully escaped for potentially dangerous tokens, and in some cases are rendered in browser as valid html tags. Details Attributes passed to the widget (such as labelfield) containing <, , and similar tokens are not fully escaped. This results in some raw values reaching the widget, and rendering in part or fully. For example, a label of: "Test User <scriptI can pass this to the labelfield and it gets rendered</script" is rendered in the choices's label visually as "Test User " with the trailing space, and what appears as an un-executed script tag following it (which is visible when viewing source). The actual output rendered in the browser for this example is: <div role="option" data-value="63f205b6" class="item" data-ts-item=""Test User <scriptI can pass this to the labelfield and it gets rendered</script</div The script tags appears to be valid in Chrome dev tools, but doesn't appear execute…
Recommended action: Upgrade to 2025.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.