# CVE-2026-61597: djust stored/reflected XSS via javascript: URLs in component tags

Source: https://junglewise.ai/threats/cve-2026-61597-djust-stored-reflected-xss-via-javascript-urls-in-component-tags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61597 · Severity: medium · CVSS 4 · Published 2026-09-16

djust is a Django template component library that renders user-supplied URLs in interactive elements (links, navigation, forms) without checking whether those URLs are safe. An attacker can inject javascript: URLs that execute arbitrary JavaScript when a user clicks the link or button, potentially stealing session cookies or performing actions on behalf of the victim. This affects any djust application that displays user-controlled URLs in breadcrumbs, navigation menus, forms, or other built-in components.

Technologies: [djust (PyPI)](https://junglewise.ai/threats/technologies/djust). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61597 being exploited in the wild.

**How severe is CVE-2026-61597?** Medium severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

**Is there a fix for CVE-2026-61597?** Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61597 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61597?** Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- djust (PyPI): upgrade to 1.0.7 or later

  ```sh
  pip install "djust>=1.0.7"
  ```


## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in djust's component template tags (djust.components.templatetags.*). Multiple sinks—including breadcrumb, dj_nav, citation URL, cookie-consent privacy link, error-page action, and form action—accept URL parameters and render them into HTML href, action, or formaction attributes using Django's conditional_escape() for HTML escaping. However, conditional_escape() only neutralizes breakout characters; it does not validate or filter URL schemes. A malicious URL such as javascript:alert(document.cookie) passes through HTML-escaping unchanged and executes in the victim's browser on click. Case-insensitive scheme matching (e.g., JaVaScRiPt:) also bypasses naive filters. The vulnerability requires either a user click (reflected XSS) or URL storage across users (stored XSS). The fix, released in v1.0.7, adds a safe_url() helper that allowlists safe schemes (http, https, mailto, tel, relative, anchor) and neutralizes dangerous ones (javascript:, vbscript:, data:) to #.

## Affected products

- djust-org djust < 1.0.7

## Identifiers

- CVE-2026-61597
- GHSA-4mf4-73j6-mvrw
- PYSEC-2026-4037

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: patched: v1.0.7 released
- 2026-09-16: advisory: Published to GitHub Advisory Database

## References

- [https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw](https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw)
- [https://github.com/djust-org/djust/releases/tag/v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)
- [https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-4mf4-73j6-mvrw](https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-4mf4-73j6-mvrw)

## Related threats

- [djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.](https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side)
- [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf)
- [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871)
- [djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse)
- [djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor)