---
title: "Django 5.0.10 release notes"
version: 5.0
locale: zh-hans
source: https://docs.djangoproject.com/zh-hans/5.0/releases/5.0.10/
canonical: https://djangodocs.dev/zh-hans/5.0/releases/5.0.10/
---
# Django 5.0.10 release notes

*December 4, 2024*

Django 5.0.10 fixes one security issue with severity "high" and one security
issue with severity "moderate" in 5.0.9.

## CVE-2024-53907: Denial-of-service possibility in `strip_tags()`

[`strip_tags()`](/zh-hans/5.0/ref/utils/#django.utils.html.strip_tags) would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The `strip_tags()` method is used to implement the corresponding
[`striptags`](/zh-hans/5.0/ref/templates/builtins/#std-templatefilter-striptags) template filter, which was thus also vulnerable.

`strip_tags()` now has an upper limit of recursive calls to `HTMLParser`
before raising a [`SuspiciousOperation`](/zh-hans/5.0/ref/exceptions/#django.core.exceptions.SuspiciousOperation) exception.

请记住，`strip_tags()` 的结果绝对不保证是安全的 HTML。因此，在将 `strip_tags()` 调用的结果标记为安全之前，绝对不要忘记首先进行转义，例如使用 [`django.utils.html.escape()`](/zh-hans/5.0/ref/utils/#django.utils.html.escape)。

## CVE-2024-53908: Potential SQL injection via `HasKey(lhs, rhs)` on Oracle

Direct usage of the `django.db.models.fields.json.HasKey` lookup on Oracle
was subject to SQL injection if untrusted data was used as a `lhs` value.

Applications that use the [`has_key`](/zh-hans/5.0/topics/db/queries/#std-fieldlookup-jsonfield.has_key) lookup through
the `__` syntax are unaffected.