{"action":"Upgrade django to 1.10.8 or later.","affected":[{"fixed":"1.10.8","introduced":"1.10"},{"fixed":"1.11.5","introduced":"1.11"}],"component":"django","cve_ids":["CVE-2017-12794"],"ecosystem":"PyPI","epss":0.23566,"exploited":false,"fixed_versions":["1.10.8","1.11.5"],"ghsa_id":"GHSA-9r8w-6x8c-6jr9","id":"tcs_01M5KG7AAD4PHP0T8HFEA6W0G3","modified_at":"2023-11-08T03:58:54.215558Z","published_at":"2017-09-07T13:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-44","https://www.djangoproject.com/weblog/2017/sep/05/security-releases/","http://www.securitytracker.com/id/1039264","http://www.securityfocus.com/bid/100643","https://usn.ubuntu.com/3559-1/","https://github.com/advisories/GHSA-9r8w-6x8c-6jr9"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-44","url":"https://osv.dev/vulnerability/PYSEC-2017-44"}],"summary":"In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cro"}