AIKIDO-2026-672293
Django is vulnerable to Cross-Site Scripting (XSS)
61
Medium Risk
This Affects:
DjangoTL;DR
The Django admin renders URLField values as clickable links on changelist and read-only field views through display_for_field. The link is generated without validating the stored value as a safe URL, so a value using a dangerous scheme such as javascript: is emitted. A staff user who clicks the link then executes externally influenced script in the admin, resulting in stored cross-site scripting. The fix validates the value with URLValidator and falls back to plain text when validation fails.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application persists URLField values from untrusted input without model validation and displays them in the Django admin.
Background info
Django is vulnerable to Cross-Site Scripting (XSS) in versions 5.2.0 - 5.2.16 and 6.0.0 - 6.0.7.
How to fix this
Upgrade the Django library to the patch version.
Links
Fix Commits
github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931bgithub.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46dgithub.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508agithub.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349Other
docs.djangoproject.com/en/5.2/releases/5.2.17/docs.djangoproject.com/en/dev/releases/security/groups.google.com/g/django-announcedjangoproject.com/weblog/2026/aug/04/security-releases/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant