CVE-2025-24370

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality `set_property_value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five ways of vulnerability exploitation have been observed, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. This issue has been addressed in version 0.62.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-915

• https://github.com/adamghill/django-unicorn/commit/17614200f27174f789d4af54cc3a1f2b0df7870c
• https://github.com/adamghill/django-unicorn/security/advisories/GHSA-g9wf-5777-gq43

Published

Feb 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24364vaultwarden is an unofficial Bitwarden compatible server wri…7.2
• CVE-2025-24365vaultwarden is an unofficial Bitwarden compatible server wri…7.5
• CVE-2025-24366SFTPGo is an open source, event-driven file transfer solutio…7.5
• CVE-2025-24367Cacti is an open source performance and fault management fra…8.8
• CVE-2025-24368Cacti is an open source performance and fault management fra…7.5
• CVE-2025-24369Anubis is a tool that allows administrators to protect bots …2.3
• CVE-2025-24371CometBFT is a distributed, Byzantine fault-tolerant, determi…7.1
• CVE-2025-24372CKAN is an open-source DMS (data management system) for powe…7.3
• CVE-2025-24373woocommerce-pdf-invoices-packing-slips is an extension which…6.5
• CVE-2025-24374Twig is a template language for PHP. When using the ?? opera…4.3
• CVE-2025-24375Charmed MySQL K8s operator is a Charmed Operator for running…5
• CVE-2025-24376kubewarden-controller is a Kubernetes controller that allows…6.5