Django 5.1.10 release notes — Django 6.0.4 documentation（2026）
Django 5.1.10 release notes¶
June 4, 2025
Django 5.1.10 fixes a security issue with severity "low" in 5.1.9.
CVE-2025-48432: Potential log injection via unescaped request path¶
Internal HTTP response logging used request.path directly, allowing control
characters (e.g. newlines or ANSI escape sequences) to be written unescaped
into logs. This could enable log injection or forgery, letting attackers
manipulate log appearance or structure, especially in logs processed by
external systems or viewed in terminals.
Although this does not directly impact Django's security model, it poses risks
when logs are consumed or interpreted by other tools. To fix this, the internal
django.utils.log.log_response() function now escapes all positional
formatting arguments using a safe encoding.
Last update:
4月 20, 2026
本文整理自 Django 6.0 官方中文文档，转载请注明出处。
上一篇：Django 5.1.1 版本发行说明 — Django 6.0.4 documentation（2026）
下一篇：Django 5.1.11 release notes — Django 6.0.4 documentation（2026）