AIKIDO-2026-672293
Django is vulnerable to Cross-Site Scripting (XSS)
61
CVE Score
Medium
Cross-Site Scripting (XSS)
TL;DR
The Django admin renders URLField values as clickable links on changelist and read-only field views through display_for_field. The link is generated without validating the stored value as a safe URL, so a value using a dangerous scheme such as javascript: is emitted. A staff user who clicks the link then executes externally influenced script in the admin, resulting in stored cross-site scripting. The fix validates the value with URLValidator and falls back to plain text when validation fails.
How do I fix this?
Upgrade the Django library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application persists URLField values from untrusted input without model validation and displays them in the Django admin.
Package
Versions
5.2.0 - 5.2.16
Fixed in 5.2.176.0.0 - 6.0.7
Fixed in 6.0.8Background info
Django is vulnerable to Cross-Site Scripting (XSS) in versions 5.2.0 - 5.2.16 and 6.0.0 - 6.0.7.
Links
Fix Commits
github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931bgithub.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46dgithub.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508agithub.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349Other
docs.djangoproject.com/en/5.2/releases/5.2.17/docs.djangoproject.com/en/dev/releases/security/groups.google.com/g/django-announcedjangoproject.com/weblog/2026/aug/04/security-releases/
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.