Executive brief
djust is a Django template component library that renders user-supplied URLs in interactive elements (links, navigation, forms) without checking whether those URLs are safe. An attacker can inject javascript: URLs that execute arbitrary JavaScript when a user clicks the link or button, potentially stealing session cookies or performing actions on behalf of the victim. This affects any djust application that displays user-controlled URLs in breadcrumbs, navigation menus, forms, or other built-in components.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in djust's component template tags (djust.components.templatetags.*). Multiple sinks—including breadcrumb, dj_nav, citation URL, cookie-consent privacy link, error-page action, and form action—accept URL parameters and render them into HTML href, action, or formaction attributes using Django's conditional_escape() for HTML escaping. However, conditional_escape() only neutralizes breakout characters; it does not validate or filter URL schemes. A malicious URL such as javascript:alert(document.cookie) passes through HTML-escaping unchanged and executes in the victim's browser on click. Case-insensitive scheme matching (e.g., JaVaScRiPt:) also bypasses naive filters. The vulnerability requires either a user click (reflected XSS) or URL storage across users (stored XSS). The fix, released in v1.0.7, adds a safe_url() helper that allowlists safe schemes (http, https, mailto, tel, relative, anchor) and neutralizes dangerous ones (javascript:, vbscript:, data:) to #.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: v1.0.7 released
- 2026-09-16: advisory: Published to GitHub Advisory Database