Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended ispublic protection to modify internal attributes such as templatename or trigger protected methods. Vulnerability Details: Component Access Control Bypass Security analysis identified that the framework fails to enforce visibility boundaries defined by ispublic within the action parsers. Specifically, the logic in setpropertyvalue() and callmethodname() utilizes getattr and setattr directly on component instances without verifying if the target attribute or method is explicitly marked as public. Vulnerability resides in: - src/djangounicorn/views/actionparsers/callmethod.py - src/djangounicorn/views/actionparsers/utils.py While Django's template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from…
Recommended action: Upgrade to 0.67.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality `set_property_value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. At least five ways of vulnerability exploitation have been found, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. Analysis of Vulnerable Function By taking a look at the vulnerable function `set_property_value` located at: `django_unicorn/views/action_parsers/utils.py`. You can observe the functionality is responsible for modifying a property value of an object. The property is specified by a dotted…
Recommended action: Upgrade to 0.62.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Unicorn framework through 0.35.3 for Django allows XSS via component.name.
Recommended action: Upgrade to 0.36.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
Recommended action: Upgrade to 0.36.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.