CVE-2016-6186: Cross-Site Scripting (XSS) Vulnerability in Django
Summary
CVE-2016-6186: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10r... Affects django across 5 version ranges.
< 1.8.14
>= 1.9, < 1.9.8
>= 1.10a0, < 1.10rc1
< d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
< f68e5a99164867ab0e071a936470958ed867479d
Fixed in 1.8.14, 1.9.8 or 1.10rc1, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2016-6186 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a high-level API for handling common web development tasks, such as URL routing, database integration, and template rendering. Django is widely used and has a large community of developers.
However, Django versions before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability exists in the dismissChangeRelatedObjectPopup function in the admin/RelatedObjectLookups.js file. Attackers can exploit this vulnerability to inject arbitrary web script or HTML into the application.
Vulnerability Detail
The vulnerability (CVE-2016-6186) in Django allows remote attackers to execute arbitrary web script or HTML by exploiting unsafe usage of Element.innerHTML in the dismissChangeRelatedObjectPopup function. This function is part of the admin/RelatedObjectLookups.js file. By injecting malicious code, attackers can manipulate the application's behavior, potentially leading to session hijacking, data theft, or other security breaches. This vulnerability affects Django versions before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.141.8.14pip install --upgrade "django==1.8.14" -
>= 1.9, < 1.9.81.9.8pip install --upgrade "django==1.9.8" -
>= 1.10a0, < 1.10rc11.10rc1pip install --upgrade "django==1.10rc1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented. Developers can modify the affected code in the admin/RelatedObjectLookups.js file to ensure safe usage of Element.innerHTML. This can be achieved by properly escaping user input or using alternative methods for DOM manipulation. Here is an example of how the code can be modified:
// Original code
Element.innerHTML = user_input;
// Modified code
Element.textContent = user_input;
Please note that this workaround is not a permanent solution and should be replaced with the official patch as soon as possible.
Conclusion
The cross-site scripting (XSS) vulnerability in Django versions before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 can allow attackers to inject arbitrary web script or HTML into the application. This can lead to various security risks, including session hijacking and data theft. It is crucial to upgrade Django to the fixed versions or apply the provided workaround to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to inject arbitrary web script or HTML into the application, potentially leading to session hijacking, data theft, or other security breaches.
Django versions before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 are affected by this vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Django application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this XSS vulnerability.
While specific exploits targeting this vulnerability may exist, they have not been disclosed publicly at the time of this report. However, it is crucial to patch the vulnerability as soon as possible to prevent potential exploitation.
Yes, the Django project has released fixed versions (1.8.14, 1.9.8, and 1.10rc1) that address this vulnerability. It is recommended to upgrade to one of these versions or later to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
