django-crm vulnerabilities

2 known vulnerabilities in django-crm from DjangoCRM. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  django-crm: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2026-71239Aug 5, 2026DjangoCRM

  DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content d

• 9.1 Critical severity

  django-crm: Use of Hard-coded Credentials

  CVE-2026-71238Aug 5, 2026DjangoCRM

  DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the