CVE-2026-15920

Name of the Vulnerable Software and Affected Versions Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7

Description An issue exists where django.contrib.admin.utils.display for field() renders URLField values as clickable links in the admin interface without proper validation. This allows stored cross-site scripting (XSS) against staff users who click the link if a value with an unsafe scheme is stored in the database. This occurs in applications that persist URLField data without running model validation, such as through direct queryset writes, deserialization, or bulk import of untrusted input.

Recommendations Update Django versions 5.2 through 5.2.16 to version 5.2.17. Update Django versions 6.0 through 6.0.7 to version 6.0.8.