CVE-2026-15920: Django URLField Cross-Site Scripting Vulnerability
Summary
CVE-2026-15920: Potential cross-site scripting via URLField values in the admin. Affects django across 2 version ranges.
>= 5.2.0, < 5.2.17
>= 6.0.0, < 6.0.8
Fixed in 5.2.17 or 6.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an admin interface for managing application data. However, certain versions of Django are vulnerable to a cross-site scripting (XSS) issue when rendering URLField values in the admin interface, particularly if unsafe URLs are stored in the database.
Vulnerability Detail
An issue was discovered in Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8. The vulnerability arises from the django.contrib.admin.utils.display_for_field() function, which renders URLField values as clickable links without validating the URL. If an unsafe URL scheme is stored in the database, it can lead to cross-site scripting attacks against staff users who click on the link. This vulnerability requires that the unsafe value is already present in the database, typically through direct writes, deserialization, or bulk imports of untrusted input.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.2.0, < 5.2.175.2.17 -
>= 6.0.0, < 6.0.86.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that all URLField data is validated before being saved to the database. This can be done by using Django's ModelForm or by manually validating the URLs to reject any unsafe schemes.
Conclusion
CVE-2026-15920 is a significant vulnerability affecting certain versions of Django, allowing for potential cross-site scripting attacks through unvalidated URLField values. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for django →
FAQ
CVE-2026-15920 is a vulnerability in Django that allows cross-site scripting via unsafe URLField values in the admin interface.
Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to cross-site scripting attacks, potentially compromising the security of staff users who interact with the admin interface.
If an immediate update is not possible, implement validation for URLField data to ensure that unsafe URLs are not stored in the database.
Related vulnerabilities
Recent vulnerabilities recorded for django.
