CVE-2026-129155: DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filter
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the classfilter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and who is exposed to the payload?
An authenticated user who can post comments can exploit the issue. The stored payload executes for every visitor who views the affected comment, including administrators.
What input is required to trigger script execution?
The attacker can submit a comment containing a div element with autofocus and onfocus attributes. The sanitizer allows event-handler attributes on span, div, pre, and code tags.
Is user interaction required for exploitation?
No. A div with autofocus and onfocus can execute script without interaction when visitors view the comment.