CVE-2017-12794: In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the...

Security readout for executives and security teams

This Django flaw could let an attacker trigger cross-site scripting through the technical 500 debug page because part of that page did not autoescape HTML. Most production sites should not be affected unless they were running Django with DEBUG=True, which exposes the debug page. Exposure is mainly Django applications on the affected versions with DEBUG=True in an accessible environment. Production sites following Django guidance to disable DEBUG are unlikely to expose this page. Treat this as a configuration-sensitive web risk. Prioritize any internet-facing Django service running affected versions or DEBUG=True; otherwise handle through normal dependency maintenance. Mitigation focus: Upgrade Django 1.10.x to 1.10.8 or later.; Upgrade Django 1.11.x to 1.11.5 or later.; Ensure DEBUG=False in production settings..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.