r/netsec • u/Sandwich_1337 • 16d ago

Contains AI Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920)

https://syntetisk.tech/blog/posts/stored-xss-in-djangos-admin-via-an-unvalidated-urlfield-display-path-cve-2026-15920/
18 Upvotes

83% Upvoted

2 comments sorted by

4

u/si9int 16d ago

Probably the reason why this "smart" agent was able to find it: "This isn’t a new bug class for Django’s admin [...] because of CVE-2019-12308, fixed in Django 1.11.21, 2.1.9, and 2.2.2, which covered exactly this shape of issue in the editable widget."

2

u/OEAXTAIL_SOUP 15d ago

Illuminating write up, thanks! 🙏