CVE-2026-28222: Wagtail Cross-site Scripting Vulnerability in TableBlock Class Attributes

Background

Wagtail is an open-source content management system (CMS) built on Django, designed for managing and publishing content on websites. It features a flexible StreamField that allows users to create complex layouts using various block types, including TableBlock. However, a vulnerability exists in the TableBlock class, which can be exploited to execute arbitrary JavaScript code through crafted class attributes.

Vulnerability Detail

A stored Cross-site Scripting (XSS) vulnerability is present in the rendering of TableBlock blocks within a StreamField. Users with permissions to create or edit pages containing these blocks can set malicious class attributes that execute JavaScript when the page is viewed. This poses a risk, particularly when viewed by users with higher privileges, as it could lead to unauthorized actions being performed with their credentials. The vulnerability specifically affects sites utilizing the TableBlock feature.

pip install --upgrade "wagtail==8.0.1"

Workaround

If upgrading is not feasible, you can mitigate the vulnerability by setting a template attribute on all TableBlock definitions. This template should not output class attributes. Here is an example of how to define a TableBlock with a secure template:

<!-- For use with TableBlock(template="path/to/table_block.html") -->
<table>
    {% if table_caption %}
        <caption>{{ table_caption }}</caption>
    {% endif %}
    {% if table_header %}
        <thead>
            <tr>
                {% for cell in table_header %}
                    <th scope="col">{{ cell }}</th>
                {% endfor %}
            </tr>
        </thead>
    {% endif %}
    <tbody>
        {% for row in data %}
            <tr>
                {% for cell in row %}
                    {% if first_col_is_header and forloop.first %}
                        <th scope="row">{{ cell }}</th>
                    {% else %}
                        <td>{{ cell }}</td>
                    {% endif %}
                {% endfor %}
            </tr>
        {% endfor %}
    </tbody>
</table>

Conclusion

The vulnerability identified as CVE-2026-28222 in Wagtail poses a significant risk due to its potential for Cross-site Scripting attacks. It is crucial for users to either upgrade to the patched versions or implement the suggested workarounds to safeguard their applications.

See every vulnerability recorded for wagtail →

FAQ