Cross-site scripting in Django - CVE-2026-15920

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU140945

Cross-site scripting in Django - CVE-2026-15920

Published: August 5, 2026


Vulnerability identifier: #VU140945
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-15920
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to improper neutralization of input during web page generation in admin URLField rendering when displaying stored URLField values as clickable links. A remote user can store a URLField value with a dangerous scheme to execute arbitrary script in a user's browser.

The issue affected changelist views and read-only fields rendered through display_for_field.


Affected software

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
python311-Django
python-django
python3-Django
python-django-help
python-django5
python-django6

How to mitigate CVE-2026-15920

Install security update from vendor's website.

Django - addressed in versions 5.2.17, 6.0.8
python311-Django - update to 4.2.11-150600.3.65.1
python-django - update to 4.2.15-18
python3-Django - update to 4.2.15-18
python-django-help - update to 4.2.15-18
python-django5 - addressed in versions 5.2.17-2.fc43, 5.2.17-2.fc44, 5.2.17-2.fc45
python-django6 - addressed in versions 6.1.1-2.fc44, 6.1.1-2.fc45

External References

Related Security Bulletins