Executive brief
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
Affected products
- PyPI django-unicorn
Junglewise Threat Intelligence
CVE-2025-24370: PYSEC-2026-329 - Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CVE-2025-24370 · Severity: medium · CVSS 4 · Published 2026-06-29
Technologies: django-unicorn (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2451 - django-unicorn affected by component state manipulation via unvalidated attribute access
- PYSEC-2021-369 - The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021
- PYSEC-2021-357 - The Unicorn framework through 0.35.3 for Django allows XSS via component.name.