https://reddit.com/r/cybersecurity/comments/1vg98d6/stored_xss_in_djangos_admin_via_an_unvalidated/: Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920)
Published Aug 5, 2026
·Updated
Affected Software
1 affected component
Django Django>5.2.17<6.0.8
Frequently Asked Questions
1
What is the severity of CVE-2026-15920?
CVE-2026-15920 is classified as a high-severity vulnerability due to its potential for executing arbitrary JavaScript code in the Django admin interface.
2
How do I fix CVE-2026-15920?
To fix CVE-2026-15920, upgrade Django to version 6.0.8 or 5.2.17, which include the necessary security patches.
3
What type of vulnerability is CVE-2026-15920?
CVE-2026-15920 is a stored cross-site scripting (XSS) vulnerability that affects the URLField in Django's admin panel.
4
When was CVE-2026-15920 published?
CVE-2026-15920 was published on August 5, 2026.
5
How does the CVE-2026-15920 vulnerability affect Django applications?
This vulnerability allows attackers to store and execute JavaScript code by injecting a malicious URL into the URLField, potentially compromising the application's security.