PT-2026-94123 · Pypi · Djust
CVE-2026-61597
·
Published
2026-09-16
·
Updated
2026-09-16
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
djust versions prior to 1.0.7
Description
Many built-in component template tags (
djust.components.templatetags.*) render developer or user-supplied URLs into href or action attributes. While the software uses conditional escape for HTML escaping, it fails to validate the URL scheme. This allows the injection of javascript: URIs, which are not neutralized by HTML escaping, leading to Cross-Site Scripting (XSS) when a victim clicks the link. Affected sinks include breadcrumbs, dj nav links, dropdowns, brands, citation URLs, cookie-consent privacy links, error-page actions, and form action attributes.Recommendations
Update to version 1.0.7.
As a temporary workaround, do not pass user-controllable URLs to the affected built-in component tags and pre-validate URL schemes in application code before binding them to component arguments.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Djust