Cross-site Scripting Vulnerability in Django Admin for URLField Rendering
CVE-2026-15920

5.1MEDIUM

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
4 August 2026

Badges

📰 News Worthy

What is CVE-2026-15920?

A vulnerability in Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8 allows for cross-site scripting attacks due to improper validation of URLField values rendered in the admin interface. This issue arises when unsafe scheme values are displayed as clickable links without proper sanitization, posing a risk to staff users who may activate these links. This vulnerability can be exploited when unsafe URLField data is stored in the database through methods that bypass model validation, such as direct database writes or unvalidated data imports. Django has released patches to address this flaw.

Affected Version(s)

Django 6.0 < 6.0.8

Django 5.2 < 5.2.17

Django 6.0.8

News Articles

favicon imageSyntetisk

Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920)

Django's admin auto-linked URLField values without validating the scheme — a stored javascript: value rendered as a live link. Fixed in 6.0.8 and 5.2.17.

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/47511a21026cdd721...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 📰

    First article discovered by Syntetisk

  • Vulnerability published

  • Vulnerability Reserved

Credit

Egor Saltykov
Natalia Bidart
Natalia Bidart
.