Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
| OWASP | A07:2017 - Cross-Site Scripting (XSS) |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
Defining a html method in Django tells the template engine that your data is safe to render without escaping, which can unintentionally allow untrusted input to be output as raw HTML. This makes it easy to introduce cross-site scripting (XSS) vulnerabilities if any user-controlled data is returned.
Impact#
If exploited, attackers could inject malicious scripts into your web pages, leading to data theft, session hijacking, or defacement of your site. This could compromise user data, damage your application’s reputation, and expose your organization to compliance risks.