CVE-2021-32681: Cross-site Scripting in wagtail
Summary
CVE-2021-32681: Cross-site Scripting in wagtail. Affects wagtail across 3 version ranges.
< 2.11.8
>= 2.12, < 2.12.5
>= 2.13, < 2.13.2
Fixed in 2.11.8, 2.12.5 or 2.13.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on Django, designed to provide a user-friendly interface for managing website content. It utilizes a StreamField feature that allows users to create dynamic content blocks. However, when the {% include_block %} template tag is used to output the value of a plain-text StreamField block without a specified rendering template, the tag output is not properly escaped as HTML. This vulnerability can be exploited by users with 'editor' access to the Wagtail admin, enabling them to insert arbitrary HTML or scripting.
Vulnerability Detail
The vulnerability arises from the lack of proper HTML escaping in the {% include_block %} template tag when rendering plain-text StreamField blocks. This allows users with 'editor' access to the Wagtail admin to inject arbitrary HTML or scripting. The impact of this vulnerability is limited to users who can author StreamField content. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.11.82.11.8pip install --upgrade "wagtail==2.11.8" -
>= 2.12, < 2.12.52.12.5pip install --upgrade "wagtail==2.12.5" -
>= 2.13, < 2.13.22.13.2pip install --upgrade "wagtail==2.13.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not feasible, site implementors should audit their use of {% include_block %} to ensure it is not used to output CharBlock / TextBlock values without an associated template. In such cases, the tag can be replaced with Django's {{ ... }} syntax. For example, {% include_block my_title_block %} becomes {{ my_title_block }}.
Conclusion
The Cross-site Scripting vulnerability in wagtail allows users with 'editor' access to inject arbitrary HTML or scripting. Upgrading to the patched versions or applying the recommended workarounds will mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open-source content management system (CMS) built on Django, providing a user-friendly interface for managing website content.
The vulnerability allows users with 'editor' access to the Wagtail admin to inject arbitrary HTML or scripting when using the {% include_block %} template tag to output plain-text StreamField blocks without a specified rendering template.
Only users with the ability to author StreamField content (i.e., users with 'editor' access to the Wagtail admin) can exploit this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Wagtail: 2.11.8 (for the LTS 2.11 branch), 2.12.5, or 2.13.2 (for the current 2.13 branch). Alternatively, you can disable escaping by surrounding the relevant {% include_block %} tag with {% autoescape off %}...{% endautoescape %}.
If upgrading to a patched version is not possible, you can audit your use of {% include_block %} to ensure it is not used to output CharBlock / TextBlock values without an associated template. In such cases, you can replace the tag with Django's {{ ... }} syntax.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
