Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-04T15:48:40 django: Django: Cross-site scripting via unvalidated URLField values in the admin 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CWE-79

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

A flaw was found in Django. The `django.contrib.admin.utils.display_for_field()` function renders `URLField` values as clickable links in the administrative interface without proper validation. If an application persists `URLField` data containing an unsafe scheme without running model validation, a remote attacker could store a malicious URL. When a staff user clicks this link on changelist or read-only admin pages, it could lead to cross-site scripting (XSS), allowing the attacker to execute arbitrary scripts in the user's browser.

Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/hub-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/ansible-dev-tools-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/eda-controller-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/gateway-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/ansible-dev-tools-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/aap-cloud-billing-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/ansible-dev-tools-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Out of support scope ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-tech-preview/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Out of support scope automation-controller Red Hat Ansible Automation Platform 2 Fix deferred python-django Red Hat Discovery 2 Fix deferred discovery/discovery-server-rhel9 Red Hat OpenStack Platform 16.2 Out of support scope python-django20 Red Hat OpenStack Platform 17.1 Out of support scope python-django Red Hat OpenStack Platform 18.0 Fix deferred python-django Red Hat Satellite 6 Fix deferred python-django Red Hat Satellite 6 Fix deferred satellite-capsule:el8/python-django Red Hat Satellite 6 Fix deferred satellite/iop-advisor-backend-rhel9 Red Hat Update Infrastructure 4 for Cloud Providers Out of support scope python-django Red Hat Update Infrastructure 5 Fix deferred rhui5/rhua-rhel9 Self-service automation portal 2 Fix deferred ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-15920 https://nvd.nist.gov/vuln/detail/CVE-2026-15920 https://docs.djangoproject.com/en/dev/releases/security/ https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349 https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2026/aug/04/security-releases/