CVE-2020-15118: HTML Injection in Wagtail
Summary
CVE-2020-15118: In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the wagtail.contrib.forms app, and the page template is built using Django's standard form rendering helpers... Affects wagtail across 3 version ranges.
>= 2.7, < 2.7.4
>= 2.9, < 2.9.3
< d9a41e7f24d08c024acc9a3094940199df94db34
Fixed in 2.7.4 or 2.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) built on Django, designed to create flexible and user-friendly websites. It allows editors to manage and publish content easily. However, Wagtail versions before 2.7.4 and 2.9.3 are vulnerable to HTML injection when using form page types with Django's form rendering helpers. This vulnerability allows editors to insert arbitrary HTML tags within a form field's help text, potentially leading to cross-site scripting (XSS) attacks and privilege escalation.
Vulnerability Detail
The vulnerability arises from the availability of HTML tags within form field help text, which is rendered unescaped on the page. While Django allows HTML in help text by design, Wagtail restricts editors from inserting arbitrary HTML to prevent XSS attacks. However, this functionality was mistakenly made available to editor-level users, creating a potential security risk. Exploitation of this vulnerability requires access to the Wagtail admin interface and cannot be carried out by ordinary site visitors. Patched versions (Wagtail 2.7.4 and 2.9.3) have been released, which escape help text to prevent the inclusion of HTML tags. Site owners can re-enable HTML in help text by setting the configuration setting WAGTAILFORMS_HELP_TEXT_ALLOW_HTML to True.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7, < 2.7.42.7.4pip install --upgrade "wagtail==2.7.4" -
>= 2.9, < 2.9.32.9.3pip install --upgrade "wagtail==2.9.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, site owners can implement the following workaround in their form page templates:
- Render forms field-by-field using Django's documentation as a guide.
- When outputting the help text, omit the |safe filter to prevent the inclusion of HTML tags.
Conclusion
Wagtail versions before 2.7.4 and 2.9.3 are vulnerable to HTML injection, allowing editors to insert arbitrary HTML tags within form field help text. This can lead to cross-site scripting (XSS) attacks and privilege escalation. Upgrading to the patched versions or implementing the provided workaround is crucial to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wagtail →
FAQ
Wagtail is an open-source content management system (CMS) built on Django, designed to create flexible and user-friendly websites.
Wagtail versions before 2.7.4 and 2.9.3 are affected by this vulnerability.
This vulnerability allows editors to insert arbitrary HTML tags within a form field's help text, potentially leading to cross-site scripting (XSS) attacks and privilege escalation.
No, this vulnerability requires access to the Wagtail admin interface and cannot be exploited by ordinary site visitors.
To fix this vulnerability, it is recommended to upgrade to the patched versions of Wagtail (2.7.4 or 2.9.3). Alternatively, you can secure your form page templates by rendering forms field-by-field as per Django's documentation, but omitting the |safe filter when outputting the help text.
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
