Junglewise Threat Intelligence

CVE-2026-61597: djust stored/reflected XSS via javascript: URLs in component tags

CVE-2026-61597 · Severity: medium · CVSS 5.1 · Published 2026-09-16

Executive brief

djust is a Django template component library that renders user-supplied URLs in interactive elements (links, navigation, forms) without checking whether those URLs are safe. An attacker can inject javascript: URLs that execute arbitrary JavaScript when a user clicks the link or button, potentially stealing session cookies or performing actions on behalf of the victim. This affects any djust application that displays user-controlled URLs in breadcrumbs, navigation menus, forms, or other built-in components.

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in djust's component template tags (djust.components.templatetags.*). Multiple sinks—including breadcrumb, dj_nav, citation URL, cookie-consent privacy link, error-page action, and form action—accept URL parameters and render them into HTML href, action, or formaction attributes using Django's conditional_escape() for HTML escaping. However, conditional_escape() only neutralizes breakout characters; it does not validate or filter URL schemes. A malicious URL such as javascript:alert(document.cookie) passes through HTML-escaping unchanged and executes in the victim's browser on click. Case-insensitive scheme matching (e.g., JaVaScRiPt:) also bypasses naive filters. The vulnerability requires either a user click (reflected XSS) or URL storage across users (stored XSS). The fix, released in v1.0.7, adds a safe_url() helper that allowlists safe schemes (http, https, mailto, tel, relative, anchor) and neutralizes dangerous ones (javascript:, vbscript:, data:) to #.

Affected products

  • djust-org djust < 1.0.7

Timeline

  • 2026-06-22: disclosed
  • 2026-06-22: patched: v1.0.7 released
  • 2026-09-16: advisory: Published to GitHub Advisory Database

References

Related threats