AIKIDO-2025-10278
django-debug-toolbar is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
10
CVE Score
Low
Exposure of Sensitive Information to an Unauthorized Actor
TL;DR
This update adds sanitization to the debug_toolbar's Request Panel, ensuring sensitive data such as GET, POST, cookies, and session values are redacted in debug output. The RequestPanel.generate_stats method now uses a new sanitize_and_sort_request_vars utility to replace the earlier unsanitized approach. Supporting helper functions (_get_sorted_keys, _process_query_dict, _process_dict) were introduced to clean and organize request data securely.
How do I fix this?
Upgrade the django-debug-toolbar library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Package
Versions
1.3.0 - 5.1.0
Fixed in 5.2.0Background info
django-debug-toolbar is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.3.0 - 5.1.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.