Executive brief
django CMS is a popular content management system used to build and manage websites. When a plugin fails to render in the editor, the system displays an error message to help content editors debug the issue. A flaw in how this error message is displayed allows editors with plugin-editing permissions to inject malicious code that executes in other staff members' browsers when they view the same content. This could lead to account compromise or unauthorized actions performed on behalf of administrative users.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in django CMS's plugin exception rendering path. When a plugin's render() method throws an exception, ContentRenderer.render_exception() constructs a message by concatenating unsanitized values including the exception message, placeholder string representation, placeholder.source, and instance.get_short_description(). This message is embedded directly into an HTML heading and returned via mark_safe(), bypassing Django's template autoescaping. An attacker with staff/plugin-editing privileges can store JavaScript in plugin model fields that feed into get_short_description(), then trigger an exception during edit-mode rendering. The payload executes in the staff editor's browser with their session privileges. The fix applies format_html() to escape the message before inserting it into the heading. The vulnerability requires low privileges (staff access) and user interaction (viewing the error), with attack scope crossing from the vulnerable component to affect other users.
Affected products
- Django Software Foundation django-cms >= 5.0.8, < 5.0.9
Timeline
- 2026-07-10: disclosed: Vulnerability initially reported
- 2026-08-20: patched: Fix released in version 5.0.9 using format_html() to escape exception message
- 2026-08-20: advisory: GitHub Security Advisory published