Stored XSS in DjangoBlog Affects Authenticated OAuth Users

CVE-2026-129156

What is CVE-2026-129156?

DjangoBlog contains a vulnerability that allows authenticated OAuth users to exploit stored cross-site scripting via unescaped nicknames in comment reactions. By manipulating the OAuth display name to include potentially malicious payloads, an attacker can close the data-reactions attribute and inject scripts, leading to unauthorized script execution in the browsers of article visitors.

References