Vulnerability-Lookup

CVE-2026-15920 (GCVE-0-2026-15920)

Vulnerability from cvelistv5 – Published: 2026-08-04 15:48 – Updated: 2026-08-04 17:21

Title

Potential cross-site scripting via URLField values in the admin

Summary

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-04 17:16 UTC

CWE

CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

Assigner

DSF CNA under the mitre root

CNA scorecard B 86/100 over 21 records in the last 180 days details

References

7 references

URL	Tags
https://docs.djangoproject.com/en/dev/releases/se…	vendor-advisory
https://groups.google.com/g/django-announce	mailing-list
https://github.com/django/django/commit/47511a210…	patch
https://github.com/django/django/commit/5a260d309…	patch
https://github.com/django/django/commit/13debb622…	patch
https://github.com/django/django/commit/b9adb8133…	patch
https://www.djangoproject.com/weblog/2026/aug/04/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
djangoproject	Django	Affected: 6.0 , < 6.0.8 (python) Unaffected: 6.0.8 (python) Affected: 5.2 , < 5.2.17 (python) Unaffected: 5.2.17 (python)	guessed

Date Public

2026-08-04 10:00

Credits

Egor Saltykov Natalia Bidart Natalia Bidart

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15920",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:16:24.319084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:21:13.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.8",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.17",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.17",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Egor Saltykov"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Natalia Bidart"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Natalia Bidart"
        }
      ],
      "datePublic": "2026-08-04T10:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\u003c/p\u003e\u003cp\u003e\u003ccode\u003edjango.contrib.admin.utils.display_for_field()\u003c/code\u003e renders \u003ccode\u003eURLField\u003c/code\u003e values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\u003c/p\u003e\u003cp\u003eExploitation requires the unsafe value to already be stored in the database. \u003ccode\u003eURLField\u003c/code\u003e validation through a \u003ccode\u003eModelForm\u003c/code\u003e or the admin rejects unsafe schemes, so this affects applications that persist \u003ccode\u003eURLField\u003c/code\u003e data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\u003c/p\u003e\u003cp\u003eDjango would like to thank Egor Saltykov for reporting this issue.\u003c/p\u003e"
            }
          ],
          "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-244",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-244: XSS Targeting URI Placeholders"
            }
          ]
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
              "value": "moderate"
            },
            "type": "Django severity rating"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T15:48:40.537Z",
        "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "shortName": "DSF"
      },
      "references": [
        {
          "name": "Django security archive",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.djangoproject.com/en/dev/releases/security/"
        },
        {
          "name": "Django releases announcements",
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/django-announce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
        },
        {
          "name": "Django security releases issued: 6.0.8 and 5.2.17",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-13T00:00:00.000Z",
          "value": "Initial report received."
        },
        {
          "lang": "en",
          "time": "2026-07-21T00:00:00.000Z",
          "value": "Vulnerability confirmed."
        },
        {
          "lang": "en",
          "time": "2026-08-04T10:00:00.000Z",
          "value": "Security release issued."
        }
      ],
      "title": "Potential cross-site scripting via URLField values in the admin",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
    "assignerShortName": "DSF",
    "cveId": "CVE-2026-15920",
    "datePublished": "2026-08-04T15:48:40.537Z",
    "dateReserved": "2026-07-15T20:32:49.882Z",
    "dateUpdated": "2026-08-04T17:21:13.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-15920",
      "date": "2026-10-23",
      "epss": "0.00354",
      "percentile": "0.27961"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pypi.org/project/Django/",
                "defaultStatus": "unaffected",
                "packageName": "django",
                "product": "Django",
                "repo": "https://github.com/django/django/",
                "vendor": "djangoproject",
                "versions": [
                  {
                    "lessThan": "6.0.8",
                    "status": "affected",
                    "version": "6.0",
                    "versionType": "python"
                  },
                  {
                    "status": "unaffected",
                    "version": "6.0.8",
                    "versionType": "python"
                  },
                  {
                    "lessThan": "5.2.17",
                    "status": "affected",
                    "version": "5.2",
                    "versionType": "python"
                  },
                  {
                    "status": "unaffected",
                    "version": "5.2.17",
                    "versionType": "python"
                  }
                ]
              }
            ],
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E20DAA60-EC17-41F8-A6F0-C6F42F887FE6",
                    "versionEndExcluding": "5.2.17",
                    "versionStartIncluding": "5.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D2E4E199-5735-4911-92F2-73B0AA1D173E",
                    "versionEndExcluding": "6.0.8",
                    "versionStartIncluding": "6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."
          },
          {
            "lang": "es",
            "value": "Se descubri\u00f3 un problema en Django 5.2 anterior a 5.2.17 y 6.0 anterior a 6.0.8.\n\u2019django.contrib.admin.utils.display_for_field()\u2019 renderiza los valores de \u2019URLField\u2019 como enlaces clicables en el administrador sin validar la URL. Un valor almacenado con un esquema inseguro se muestra como un enlace en las p\u00e1ginas de lista de cambios y de administraci\u00f3n de solo lectura, lo que permite cross-site scripting contra los usuarios del personal que hacen clic en el enlace.\nLa explotaci\u00f3n requiere que el valor inseguro ya est\u00e9 almacenado en la base de datos. La validaci\u00f3n de \u2019URLField\u2019 a trav\u00e9s de un \u2019ModelForm\u2019 o el administrador rechaza los esquemas inseguros, por lo que esto afecta a las aplicaciones que persisten datos de \u2019URLField\u2019 sin ejecutar la validaci\u00f3n del modelo, por ejemplo, mediante escrituras directas de queryset, deserializaci\u00f3n o importaci\u00f3n masiva de entrada no confiable.\nDjango desea agradecer a Egor Saltykov por informar de este problema."
          }
        ],
        "id": "CVE-2026-15920",
        "lastModified": "2026-10-23T21:10:00.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-15920",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:16:24.319084Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-04T17:16:46.733",
        "references": [
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://docs.djangoproject.com/en/dev/releases/security/"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Mailing List"
            ],
            "url": "https://groups.google.com/g/django-announce"
          },
          {
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
          }
        ],
        "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-83"
              }
            ],
            "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-09T18:19:17+00:00",
      "cve": "CVE-2026-15920",
      "id": "CVE-2026-15920",
      "initial_release_date": "2026-08-04T15:48:40.537000+00:00",
      "product_status:known_affected": "47",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "django: Django: Cross-site scripting via unvalidated URLField values in the admin",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15920.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T01:18:57Z",
      "cve": "CVE-2026-15920",
      "id": "CVE-2026-15920",
      "initial_release_date": "2026-08-06T01:36:13Z",
      "product_status:recommended": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-15920",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-15920.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15920",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-04T17:16:24.319084Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-04T17:21:05.231Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://pypi.org/project/Django/",
              "defaultStatus": "unaffected",
              "packageName": "django",
              "product": "Django",
              "repo": "https://github.com/django/django/",
              "vendor": "djangoproject",
              "versions": [
                {
                  "lessThan": "6.0.8",
                  "status": "affected",
                  "version": "6.0",
                  "versionType": "python"
                },
                {
                  "status": "unaffected",
                  "version": "6.0.8",
                  "versionType": "python"
                },
                {
                  "lessThan": "5.2.17",
                  "status": "affected",
                  "version": "5.2",
                  "versionType": "python"
                },
                {
                  "status": "unaffected",
                  "version": "5.2.17",
                  "versionType": "python"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Egor Saltykov"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Natalia Bidart"
            },
            {
              "lang": "en",
              "type": "coordinator",
              "value": "Natalia Bidart"
            }
          ],
          "datePublic": "2026-08-04T10:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\u003c/p\u003e\u003cp\u003e\u003ccode\u003edjango.contrib.admin.utils.display_for_field()\u003c/code\u003e renders \u003ccode\u003eURLField\u003c/code\u003e values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\u003c/p\u003e\u003cp\u003eExploitation requires the unsafe value to already be stored in the database. \u003ccode\u003eURLField\u003c/code\u003e validation through a \u003ccode\u003eModelForm\u003c/code\u003e or the admin rejects unsafe schemes, so this affects applications that persist \u003ccode\u003eURLField\u003c/code\u003e data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\u003c/p\u003e\u003cp\u003eDjango would like to thank Egor Saltykov for reporting this issue.\u003c/p\u003e"
                }
              ],
              "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-244",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-244: XSS Targeting URI Placeholders"
                }
              ]
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
                  "value": "moderate"
                },
                "type": "Django severity rating"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            },
            {
              "cvssV4_0": {
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-83",
                  "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-04T15:48:40.537Z",
            "orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
            "shortName": "DSF"
          },
          "references": [
            {
              "name": "Django security archive",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://docs.djangoproject.com/en/dev/releases/security/"
            },
            {
              "name": "Django releases announcements",
              "tags": [
                "mailing-list"
              ],
              "url": "https://groups.google.com/g/django-announce"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
            },
            {
              "name": "Django security releases issued: 6.0.8 and 5.2.17",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2026-07-13T00:00:00.000Z",
              "value": "Initial report received."
            },
            {
              "lang": "en",
              "time": "2026-07-21T00:00:00.000Z",
              "value": "Vulnerability confirmed."
            },
            {
              "lang": "en",
              "time": "2026-08-04T10:00:00.000Z",
              "value": "Security release issued."
            }
          ],
          "title": "Potential cross-site scripting via URLField values in the admin",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "assignerShortName": "DSF",
        "cveId": "CVE-2026-15920",
        "datePublished": "2026-08-04T15:48:40.537Z",
        "dateReserved": "2026-07-15T20:32:49.882Z",
        "dateUpdated": "2026-08-04T17:21:13.428Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-django-2026-15920

Vulnerability from bitnami_vulndb

Published

2026-08-18 10:04

Modified

2026-09-08 08:34

Summary

Potential cross-site scripting via URLField values in the admin

Details

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.display_for_field() renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. URLField validation through a ModelForm or the admin rejects unsafe schemes, so this affects applications that persist URLField data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "django",
        "purl": "pkg:bitnami/django"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.17"
            },
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.8"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-15920"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue.",
  "id": "BIT-django-2026-15920",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2026-08-18T10:04:42.641Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.djangoproject.com/en/dev/releases/security/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
    },
    {
      "type": "FIX",
      "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
    },
    {
      "type": "FIX",
      "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
    },
    {
      "type": "DISCUSSION",
      "url": "https://groups.google.com/g/django-announce"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15920"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Potential cross-site scripting via URLField values in the admin"
}

FKIE_CVE-2026-15920

Vulnerability from fkie_nvd - Published: 2026-08-04 17:16 - Updated: 2026-10-23 21:10

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://docs.djangoproject.com/en/dev/releases/security/	Patch, Vendor Advisory
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b	Patch
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d	Patch
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a	Patch
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349	Patch
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://groups.google.com/g/django-announce	Mailing List
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92	https://www.djangoproject.com/weblog/2026/aug/04/security-releases/	Vendor Advisory

Impacted products

	Vendor	Product	Version
	djangoproject	django	*
	djangoproject	django	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.8",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.17",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.17",
              "versionType": "python"
            }
          ]
        }
      ],
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E20DAA60-EC17-41F8-A6F0-C6F42F887FE6",
              "versionEndExcluding": "5.2.17",
              "versionStartIncluding": "5.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2E4E199-5735-4911-92F2-73B0AA1D173E",
              "versionEndExcluding": "6.0.8",
              "versionStartIncluding": "6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 un problema en Django 5.2 anterior a 5.2.17 y 6.0 anterior a 6.0.8.\n\u2019django.contrib.admin.utils.display_for_field()\u2019 renderiza los valores de \u2019URLField\u2019 como enlaces clicables en el administrador sin validar la URL. Un valor almacenado con un esquema inseguro se muestra como un enlace en las p\u00e1ginas de lista de cambios y de administraci\u00f3n de solo lectura, lo que permite cross-site scripting contra los usuarios del personal que hacen clic en el enlace.\nLa explotaci\u00f3n requiere que el valor inseguro ya est\u00e9 almacenado en la base de datos. La validaci\u00f3n de \u2019URLField\u2019 a trav\u00e9s de un \u2019ModelForm\u2019 o el administrador rechaza los esquemas inseguros, por lo que esto afecta a las aplicaciones que persisten datos de \u2019URLField\u2019 sin ejecutar la validaci\u00f3n del modelo, por ejemplo, mediante escrituras directas de queryset, deserializaci\u00f3n o importaci\u00f3n masiva de entrada no confiable.\nDjango desea agradecer a Egor Saltykov por informar de este problema."
    }
  ],
  "id": "CVE-2026-15920",
  "lastModified": "2026-10-23T21:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15920",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-04T17:16:24.319084Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-04T17:16:46.733",
  "references": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://docs.djangoproject.com/en/dev/releases/security/"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Mailing List"
      ],
      "url": "https://groups.google.com/g/django-announce"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
    }
  ],
  "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-83"
        }
      ],
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "type": "Secondary"
    }
  ]
}

GHSA-8RMJ-XGQ5-W9QM

Vulnerability from github – Published: 2026-08-04 18:31 – Updated: 2026-08-04 18:31

Details

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-15920"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-83"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-04T17:16:46Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue.",
  "id": "GHSA-8rmj-xgq5-w9qm",
  "modified": "2026-08-04T18:31:27Z",
  "published": "2026-08-04T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15920"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
    },
    {
      "type": "WEB",
      "url": "https://docs.djangoproject.com/en/dev/releases/security"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/django-announce"
    },
    {
      "type": "WEB",
      "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

OESA-2026-3496 (CVE-2026-15307)

Vulnerability from osv_openeuler – Published: 2026-08-30 04:14 – Updated: 2026-08-30 04:14 – Source website

Summary

python-django security update

Details

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or RasterField reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A dict, or a str holding its JSON representation, is opened in write mode regardless of the constructor's write=False default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other str is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.check_for_language() is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the django.views.i18n.set_language() view, which is not routed by default. The consumed memory is bounded, since request data is limited by the DATA_UPLOAD_MAX_MEMORY_SIZE setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15307	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15337	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15830	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15920	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "python-django-help-4.2.15-18.oe2203sp4.noarch.rpm",
          "python3-Django-4.2.15-18.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "python-django-4.2.15-18.oe2203sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "python-django",
        "purl": "pkg:rpm/openEuler/python-django\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.15-18.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)",
  "id": "OESA-2026-3496",
  "modified": "2026-08-30T04:14:04Z",
  "published": "2026-08-30T04:14:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3496"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15307"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15337"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15830"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15920"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-django security update",
  "upstream": [
    "CVE-2026-15307",
    "CVE-2026-15337",
    "CVE-2026-15830",
    "CVE-2026-15920"
  ]
}

OESA-2026-3497 (CVE-2026-15307)

Vulnerability from osv_openeuler – Published: 2026-08-30 04:14 – Updated: 2026-08-30 04:14 – Source website

Summary

python-django security update

Details

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15307	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15337	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15830	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15920	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "python-django-help-4.2.15-18.oe2403sp1.noarch.rpm",
          "python3-Django-4.2.15-18.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "python-django-4.2.15-18.oe2403sp1.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "python-django",
        "purl": "pkg:rpm/openEuler/python-django\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.15-18.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)",
  "id": "OESA-2026-3497",
  "modified": "2026-08-30T04:14:07Z",
  "published": "2026-08-30T04:14:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3497"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15307"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15337"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15830"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15920"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-django security update",
  "upstream": [
    "CVE-2026-15307",
    "CVE-2026-15337",
    "CVE-2026-15830",
    "CVE-2026-15920"
  ]
}

OESA-2026-3498 (CVE-2026-15307)

Vulnerability from osv_openeuler – Published: 2026-08-30 04:14 – Updated: 2026-08-30 04:14 – Source website

Summary

python-django security update

Details

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15307	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15337	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15830	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15920	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "python-django-help-4.2.15-18.oe2403sp3.noarch.rpm",
          "python3-Django-4.2.15-18.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "python-django-4.2.15-18.oe2403sp3.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "python-django",
        "purl": "pkg:rpm/openEuler/python-django\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.15-18.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)",
  "id": "OESA-2026-3498",
  "modified": "2026-08-30T04:14:09Z",
  "published": "2026-08-30T04:14:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3498"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15307"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15337"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15830"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15920"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-django security update",
  "upstream": [
    "CVE-2026-15307",
    "CVE-2026-15337",
    "CVE-2026-15830",
    "CVE-2026-15920"
  ]
}

OESA-2026-3499 (CVE-2026-15307)

Vulnerability from osv_openeuler – Published: 2026-08-30 04:14 – Updated: 2026-08-30 04:14 – Source website

Summary

python-django security update

Details

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

Severity

8.7 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15307	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15337	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15830	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-15920	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "python-django-help-4.2.15-18.oe2403sp4.noarch.rpm",
          "python3-Django-4.2.15-18.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "python-django-4.2.15-18.oe2403sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "python-django",
        "purl": "pkg:rpm/openEuler/python-django\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.15-18.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)",
  "id": "OESA-2026-3499",
  "modified": "2026-08-30T04:14:12Z",
  "published": "2026-08-30T04:14:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3499"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15307"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15337"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15830"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15920"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-django security update",
  "upstream": [
    "CVE-2026-15307",
    "CVE-2026-15337",
    "CVE-2026-15830",
    "CVE-2026-15920"
  ]
}

OPENSUSE-SU-2026:11464-1

Vulnerability from csaf_opensuse - Published: 2026-08-06 00:00 - Updated: 2026-10-08 18:01

Summary

python313-Django-6.0.8-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2026-15920.

CVE-2026-15920

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 8 products

Open the full advisory

OPENSUSE-SU-2026:11465-1

Vulnerability from csaf_opensuse - Published: 2026-08-06 00:00 - Updated: 2026-10-08 18:01

Summary

python313-Django4-4.2.30-5.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2026-15920.

CVE-2026-15920

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 8 products

Open the full advisory

OPENSUSE-SU-2026:11491-1

Vulnerability from csaf_opensuse - Published: 2026-08-10 00:00 - Updated: 2026-10-08 18:02

Summary

python313-Django5-5.2.17-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2026-15920.

CVE-2026-15920

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Recommended: 8 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-15920 (GCVE-0-2026-15920)

bit-django-2026-15920

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-15920

GHSA-8RMJ-XGQ5-W9QM

OESA-2026-3496 (CVE-2026-15307)

OESA-2026-3497 (CVE-2026-15307)

OESA-2026-3498 (CVE-2026-15307)

OESA-2026-3499 (CVE-2026-15307)

OPENSUSE-SU-2026:11464-1

OPENSUSE-SU-2026:11465-1

OPENSUSE-SU-2026:11491-1

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour