DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61597: CVE-2026-61597: Cross-Site Scripting (XSS) via Unsanitized URI Schemes in djust Component Template Tags

#security #cve #cybersecurity

CVE-2026-61597: Cross-Site Scripting (XSS) via Unsanitized URI Schemes in djust Component Template Tags

Vulnerability ID: CVE-2026-61597
CVSS Score: 5.1
Published: 2026-09-16

Prior to version 1.0.7, the djust Python package is vulnerable to Stored and Reflected Cross-Site Scripting (XSS) via component template tags. The underlying issue exists because the package fails to sanitize or validate incoming URI schemes when rendering URLs inside interactive HTML attributes like href or action. While the framework HTML-escapes strings to prevent attribute breakout, it permits the execution of arbitrary JavaScript via the javascript: pseudo-protocol.

TL;DR

A vulnerability in djust (< 1.0.7) allows unauthenticated stored or reflected XSS because component template tags fail to validate URI schemes, allowing 'javascript:' payloads to execute directly upon user interaction.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS Score: 5.1
  • EPSS Score: 0.00%
  • Impact: Cross-Site Scripting (XSS)
  • Exploit Status: PoC
  • KEV Status: Not Listed

Affected Systems

  • djust Python package
  • djust: < 1.0.7 (Fixed in: 1.0.7)

Mitigation Strategies

  • Upgrade to djust version 1.0.7 or higher
  • Implement strict URI schema validation at the application boundaries
  • Avoid directly rendering raw user inputs inside interactive attributes

Remediation Steps:

  1. Identify installed djust version using 'pip show djust'
  2. Upgrade the package to '1.0.7' or newer using pip, poetry, or pipenv
  3. Audit components usage to ensure all URLs are verified

References

Read the full report for CVE-2026-61597 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)