CVE-2025-24370: Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
(updated )
Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality set_property_value
, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status.
With this finding, so far we’ve found at least five ways of vulnerability exploitation, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application.
References
- github.com/adamghill/django-unicorn
- github.com/adamghill/django-unicorn/commit/17614200f27174f789d4af54cc3a1f2b0df7870c
- github.com/adamghill/django-unicorn/releases/tag/0.62.0
- github.com/adamghill/django-unicorn/security/advisories/GHSA-g9wf-5777-gq43
- github.com/advisories/GHSA-g9wf-5777-gq43
- nvd.nist.gov/vuln/detail/CVE-2025-24370
Detect and mitigate CVE-2025-24370 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →