Cross-site Scripting (XSS) And Malicious Redirect

Django has a flaw which causes cross-site scripting and malicious redirects. This vulnerability is caused by the django.utils.http.is_safe_url() method which fails to check the user supplied URL with basic authentication credentials. This allows an attacker to bypass the URL, for example: http://mysite.example.com\@attacker.com, since http://mysite.example.com is considered to be safe. However, in reality, the supplied URL will redirect the users to attacker.com.