Cross-site scripting in Django - CVE-2026-15920
Published: August 5, 2026
Vulnerability identifier: #VU140945
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-15920
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in a user's browser.
The vulnerability exists due to improper neutralization of input during web page generation in admin URLField rendering when displaying stored URLField values as clickable links. A remote user can store a URLField value with a dangerous scheme to execute arbitrary script in a user's browser.
The issue affected changelist views and read-only fields rendered through display_for_field.
Affected software
Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
How to mitigate CVE-2026-15920
Install security update from vendor's website.
Django - addressed in versions 5.2.17, 6.0.8
python311-Django - update to 4.2.11-150600.3.65.1
python311-Django - update to 4.2.11-150600.3.65.1