CVE-2025-24370

Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting...

CVE-2025-24370

creationtimestamp| type| source ---|---|--- 2025-02-03 21:15:16+00:00| seen| https://infosec.exchange/users/cve/statuses/113942024388964254 2025-02-03 21:15:55+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhchmxrdn22p 2025-02-03 22:08:31+00:00| seen|...

CVE-2025-24370

CVE-2025-24370 affects django-unicorn. The issue stems from the vulnerable set_property_value function, which can be remotely triggered via component requests (syncInput payload) to modify Python runtime state, enabling XSS, DoS, and authentication bypass across Django-Unicorn-based apps. Remedia...