CVE-2026-15920 in Django
Summary
by MITRE • 08/04/2026
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists in Django's admin interface where the `display_for_field()` function fails to validate URL schemes when rendering `URLField` values as clickable links. The flaw allows attackers to store malicious URLs containing unsafe schemes such as javascript: or data: within the database, which are then rendered as hyperlinks in the admin changelist and read-only views. When administrative staff click these links, they become vulnerable to cross-site scripting attacks that can execute arbitrary code in their browser context.
The technical implementation of this vulnerability stems from Django's admin utility function not performing proper URL validation during display operations. While the framework correctly validates URLs through `ModelForm` validation and admin interfaces, it fails to validate scheme safety when directly rendering field values. This creates a gap where data persistence occurs without scheme validation, particularly affecting applications using direct queryset operations, deserialization processes, or bulk import mechanisms that bypass standard model validation. The vulnerability specifically impacts Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8, making it a critical security concern for developers who rely on these administrative features.
The operational impact of this vulnerability is significant as it enables privilege escalation through social engineering attacks against administrative users. Attackers need only inject malicious URLs into the database to create persistent XSS vectors that can compromise staff accounts and potentially lead to full system compromise. The attack vector requires pre-existing data persistence in the database, meaning that applications must have mechanisms allowing unvalidated URL data entry beyond standard model forms. This affects applications using bulk operations or direct database writes without proper validation layers.
Organizations should immediately upgrade to Django versions 5.2.17 or 6.0.8 to address this vulnerability. Additionally, administrators should implement input sanitization for URL fields at all persistence points including bulk import processes and direct queryset operations. Security measures should include validating URL schemes during data ingestion phases, implementing content security policies, and conducting regular security audits of database inputs. The vulnerability aligns with CWE-79 (Cross-site Scripting) and follows ATT&CK tactics including privilege escalation through social engineering and initial access via malicious links. Organizations should also consider implementing automated scanning tools to detect potentially malicious URL patterns in their database systems.