Executive brief
The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
Affected products
- PyPI django-unicorn
Junglewise Threat Intelligence
CVE-2021-42134: PYSEC-2021-369 - The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021
CVE-2021-42134 · Severity: low · CVSS 3.1 · Published 2021-10-11
Technologies: django-unicorn (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2451 - django-unicorn affected by component state manipulation via unvalidated attribute access
- PYSEC-2026-329 - Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
- PYSEC-2021-357 - The Unicorn framework through 0.35.3 for Django allows XSS via component.name.