Is CVE-2026-61597 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61597 being exploited in the wild.

How severe is CVE-2026-61597?

Medium severity, with a CVSS score of 4, published 16 September 2026.

Which products and versions are affected?

djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

Is there a fix for CVE-2026-61597?

Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61597 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61597?

Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61597: djust stored/reflected XSS via javascript: URLs in component tags

Q: Which products and versions are affected?

djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

Q: Is there a fix for CVE-2026-61597?

Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61597 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61597?

Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61597 · Severity: medium · CVSS 4 · Published 2026-09-16

djust is a Django template component library that renders user-supplied URLs in interactive elements (links, navigation, forms) without checking whether those URLs are safe. An attacker can inject javascript: URLs that execute arbitrary JavaScript when a user clicks the link or button, potentially stealing session cookies or performing actions on behalf of the victim. This affects any djust application that displays user-controlled URLs in breadcrumbs, navigation menus, forms, or other built-in components.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61597 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61597 being exploited in the wild.
How severe is CVE-2026-61597?: Medium severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?: djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61597?: Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61597 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61597?: Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

djust (PyPI): upgrade to 1.0.7 or later
```
pip install "djust>=1.0.7"
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in djust's component template tags (djust.components.templatetags.*). Multiple sinks—including breadcrumb, dj_nav, citation URL, cookie-consent privacy link, error-page action, and form action—accept URL parameters and render them into HTML href, action, or formaction attributes using Django's conditional_escape() for HTML escaping. However, conditional_escape() only neutralizes breakout characters; it does not validate or filter URL schemes. A malicious URL such as javascript:alert(document.cookie) passes through HTML-escaping unchanged and executes in the victim's browser on click. Case-insensitive scheme matching (e.g., JaVaScRiPt:) also bypasses naive filters. The vulnerability requires either a user click (reflected XSS) or URL storage across users (stored XSS). The fix, released in v1.0.7, adds a safe_url() helper that allowlists safe schemes (http, https, mailto, tel, relative, anchor) and neutralizes dangerous ones (javascript:, vbscript:, data:) to #.

Affected products

djust-org djust < 1.0.7

Identifiers

CVE-2026-61597
GHSA-4mf4-73j6-mvrw
PYSEC-2026-4037

Timeline

2026-06-22: disclosed
2026-06-22: patched: v1.0.7 released
2026-09-16: advisory: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.