Cross-site Scripting Vulnerability in Django Admin for URLField Rendering
CVE-2026-15920

5.1MEDIUM

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
4 August 2026

What is CVE-2026-15920?

A vulnerability in Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8 allows for cross-site scripting attacks due to improper validation of URLField values rendered in the admin interface. This issue arises when unsafe scheme values are displayed as clickable links without proper sanitization, posing a risk to staff users who may activate these links. This vulnerability can be exploited when unsafe URLField data is stored in the database through methods that bypass model validation, such as direct database writes or unvalidated data imports. Django has released patches to address this flaw.

Affected Version(s)

Django 6.0 < 6.0.8

Django 5.2 < 5.2.17

Django 6.0.8

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/47511a21026cdd721...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Egor Saltykov
Natalia Bidart
Natalia Bidart
.