Nixpkgs security tracker
5.1 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Passive (P)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): Low (L)
- Subsequent System Impact Integrity (SI): Low (L)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Passive (P)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Low (L)
- Modified Subsequent System Impact Integrity (MSI): Low (L)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.
References
-
https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw x_refsource_CONFIRM
-
https://github.com/djust-org/djust/releases/tag/v1.0.7 x_refsource_MISC
Affected products
- ==< 1.0.7
Matching in nixpkgs
pkgs.python313Packages.adjusttext
Iteratively adjust text position in matplotlib plots to minimize overlaps
pkgs.python314Packages.adjusttext
Iteratively adjust text position in matplotlib plots to minimize overlaps
pkgs.ankiAddons.adjust-sound-volume
Add a new menu item for adjusting the sound volume
pkgs.gnomeExtensions.displays-adjustments
Offers sliders to control external displays' brightness and contrast through DDC. Extension requires ddcutil-service to be installed.
pkgs.vscode-extensions.dendron.adjust-heading-level
VSCode extension to adjust the heading level of the selected text
pkgs.gnomeExtensions.blur-wallpaper-with-adjustable-intensity
Creates a static blurred copy of your current desktop wallpaper for better performance and artifact-free workspace switching. Set intensity from 0 to 300 and wait a moment. Note: ImageMagick (the `magick` command) must be installed.
Package maintainers
-
@junestepp June Stepp <git@junestepp.me>
-
@honnip Jung seungwoo <me@honnip.page>
-
@samuela Samuel Ainsworth <skainsworth@gmail.com>
-
@hexadecimalDinosaur Ivy Fan-Chiang <dev@ivyfanchiang.ca>