CVE-2021-46898: Vonautomatisch Django Grappelli

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.

Affected products

• Vonautomatisch Django Grappelli: before 2.15.2 (fixed in 2.15.2)

Published 2023-10-22. Last modified 2026-06-17.