CVE-2021-45116: djangoproject django Improper Input Validation
Vulnerability summary
CVE-2021-45116 is a high (CVSS 7.5) Improper Input Validation vulnerability in djangoproject django. EPSS estimates a 1.98% chance of exploitation in the next 30 days, higher than 80.5% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 4Timeline
- 04-01-2022PublishedVulnerability first disclosed.
- 22-05-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
CVSS metrics
8 scores · 6 sources · 3 versions- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.98%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
Increase +0.12 pp
From 1.85% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- py3-django< 3.2.12-r0
Debian1 product
- python-django< 2:3.2.11-1
Djangoproject1 product
- django≥ 2.2, < 2.2.26 | ≥ 3.2, < 3.2.11 | ≥ 4.0, < 4.0.1
Fedoraproject1 product
- fedoraEOL35
PyPI1 product
- django≥ 2.2, < 2.2.26 | ≥ 3.2, < 3.2.11 | ≥ 4.0, < 4.0.1
Ubuntu1 product
- python-djangoAll versions (No fix recorded) | < 1:1.11.11-1ubuntu1.15 | < 2:2.2.12-1ubuntu0.9
6 vendors · 6 products
References
22 links- groups.google.com/forum/X Refsource MISC
- www.djangoproject.com/weblog/2022/jan/04/security-releases/X Refsource CONFIRMARTICLEPatchVendor Advisory
Show all 22 references
- github.com/django/djangoPACKAGE
