Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Autoescaping is globally turned off in your Django templates, which means user input is not automatically escaped when rendered on web pages. This makes it easy for attackers to inject malicious scripts into your site.

Impact

If exploited, an attacker could execute cross-site scripting (XSS) attacks, allowing them to steal user data, hijack sessions, or deface pages. This can compromise user security and trust, potentially leading to data breaches or regulatory violations.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Using the html_safe() decorator in Django marks data as safe for HTML rendering, bypassing automatic escaping. This can allow untrusted or user-supplied input to be rendered directly in templates, making your application vulnerable to XSS attacks.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Extending Django’s ‘SafeString’, ‘SafeText’, or ‘SafeData’ classes disables automatic HTML escaping, which can allow untrusted data to be rendered as raw HTML. This practice can easily introduce cross-site scripting (XSS) vulnerabilities if any user input is included.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input is being directly inserted into manually constructed HTML strings instead of using Django templates or safe rendering methods. This practice can allow attackers to inject malicious scripts into your web pages.

Impact

If exploited, an attacker could execute JavaScript in the context of users’ browsers (Cross-Site Scripting/XSS), potentially stealing session cookies, account data, or performing actions on behalf of users. This compromises both user data and trust in your application.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

User input from the HTTP request is being directly included in an HttpResponse without proper escaping or sanitization. This allows attackers to inject malicious scripts into the response, making the application vulnerable to cross-site scripting (XSS).

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Low

Description

User input from the request is being included directly in the HttpResponseBadRequest response without sanitization or escaping. This allows attackers to inject malicious scripts into error messages shown in the browser.

Impact

If exploited, attackers could execute JavaScript in users’ browsers (XSS), potentially stealing cookies or sensitive data, hijacking sessions, or performing actions on behalf of users. This can compromise user accounts and damage the application’s reputation.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Low

Description

Rendering user data directly to the response in Pyramid without using a template engine bypasses built-in protections against cross-site scripting (XSS). This means user input could be included in HTML output without proper sanitization.

Impact

If exploited, attackers could inject malicious scripts into your web pages, allowing them to steal user data, hijack sessions, or deface your site. This exposes both your users and your application to significant security risks, including data theft and loss of trust.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Disabling HTML entity escaping in JSON responses allows untrusted user input to be included in JSON output without proper sanitization. This means special HTML characters aren’t encoded, making it easier for attackers to inject malicious scripts.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Using Rails’ content_tag() can bypass automatic HTML escaping, allowing untrusted data to be rendered directly in the browser. If external input reaches content_tag() without proper sanitization, it can introduce cross-site scripting (XSS) vulnerabilities.

Impact

An attacker could inject malicious scripts into your application’s pages, potentially stealing user data, hijacking sessions, or defacing the site. This can compromise user trust, lead to data breaches, and expose your organization to legal and reputational risks.

Property
Language
Severity
CWE	CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP	A07:2017 - Cross-Site Scripting (XSS)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

Using ‘html_safe()’ in Ruby on Rails tells the framework to trust the input and skip HTML escaping, which can let unsafe content be rendered directly in the browser. If this method is called on data that comes from users or other external sources, it can create a serious security risk.