Django 5.0.10 release notes¶
December 4, 2024
Django 5.0.10 fixes one security issue with severity “high” and one security issue with severity “moderate” in 5.0.9.
CVE-2024-53907: Denial-of-service possibility in strip_tags()¶
strip_tags() would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The strip_tags() method is used to implement the corresponding
striptags template filter, which was thus also vulnerable.
strip_tags() now has an upper limit of recursive calls to HTMLParser
before raising a SuspiciousOperation exception.
Remember that absolutely NO guarantee is provided about the results of
strip_tags() being HTML safe. So NEVER mark safe the result of a
strip_tags() call without escaping it first, for example with
django.utils.html.escape().