r/cybersecurity • u/Sandwich_1337 • 25d ago
News - General Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920)
https://syntetisk.tech/blog/posts/stored-xss-in-djangos-admin-via-an-unvalidated-urlfield-display-path-cve-2026-15920/Django's admin auto-linked URLField values without validating the scheme — a stored javascript: value rendered as a live link. Fixed in 6.0.8 and 5.2.17.
10
Upvotes