CVE-2026-61597: djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Impact Many djust built-in component template tags (djust.components.templatetags.) render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a javascript: URI (which needs no escapable characters), so a URL value of javascript:alert(document.cookie) lands verbatim in <a href="javascript:alert(document.cookie)"> and executes in the victim's session on click.
Affected sinks (executing href/action contexts; not exhaustive): breadcrumb (djustcomponents.py:1535; advanced.py:1999,2022), djnav link/dropdown/brand (djustcomponents.py:5632,5779,5807,5830), citation URL (:6936), cookie-consent privacy link (:8240), error-page action (advanced.py:1728), form action (forms.py:1239). <img src> sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at djustcomponents.py:781 even acknowledges the javascript: risk without mitigating it.
Severity Medium: XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for href requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High.
Reproduced: breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}]) emits <a ... href="javascript:alert(document.cookie)">Home</a>; JaVaScRiPt: case variant also passes; https:// URLs are preserved.
Patches Add a safeurl() helper that neutralizes non-allowlisted schemes (javascript:, vbscript:, data:) to # while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an auditast/system-check rule flagging un-routed URL-attribute interpolation.
Workarounds Do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.
References Reproducer + finding writeup retained privately by the maintainer.
Other sources
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (djust.components.templatetags.) render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a javascript: URI (which needs no escapable characters), so a URL value of javascript:alert(document.cookie) lands verbatim in <a href="javascript:alert(document.cookie)"> and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Implement a safe_url() helper that neutralizes non-allowlisted schemes (`javascript:`, `vbscript:`, `data:`) to `#` while preserving `http/https/mailto/tel` URLs, relative/anchor URLs, and route every URL-attribute sink (`href`, `action`, `formaction`, `xlink:href`) through safe_url(); then apply HTML-escaping at render time. Ensure scheme matching is case-insensitive (e.g., `JaVaScRiPt:`).
djust.components.templatetags (built-in component template tags rendering href/action/xlink:href) URL scheme validation for URL attributes via safe_url() helper = Neutralize non-allowlisted schemes (javascript:, vbscript:, data:) to "#" while preserving http/https/mailto/tel/relative/anchor URLs; route every href/action/formaction/xlink:href sink through safe_url() and then HTML-escape - Compensating control
Workaround (until the fix is applied): do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed where built-in djust component template tags place a developer- or user-supplied URL into an href or form action attribute. Risk is highest when an untrusted party can control those URL values and a victim uses the resulting link or form.
What must an attacker do to trigger the issue?
An attacker needs to supply a javascript: URL through a value rendered by an affected component tag, then induce the victim to click the rendered link or use the affected form action. The script executes in the victim's browser session.
Which component uses should be reviewed first?
Review breadcrumb, dj_nav links, dropdowns and brand links, citation URLs, cookie-consent privacy links, error-page actions, and form actions. These are identified as executing href or action contexts; image src uses are described as lower risk because javascript: does not execute through img src.
How can we identify potentially affected application code?
Find uses of djust built-in component template tags that receive URL values and determine whether those values can originate from users or other untrusted sources. HTML escaping alone is not sufficient for these contexts because it does not block the javascript: scheme.