This vulnerability in Django's admin interface involves improper neutralization of script in URLField attributes. The function django.contrib.admin.utils.display_for_field() renders URLField values as clickable links without validating the URL scheme, allowing stored unsafe schemes to execute cross-site scripting attacks on staff users. The vulnerability affects Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8. Exploitation requires unsafe URL values to be present in the database, which can happen if data bypasses model validation, for example through direct queryset writes or deserialization of untrusted input. The vulnerability is identified as CWE-83 and has a CVSS 3.1 score of 6.1 (medium severity).

Successful exploitation can lead to cross-site scripting attacks against staff users of the Django admin interface, potentially allowing attackers to execute arbitrary scripts in the context of the admin user's browser session. This can result in information disclosure or session hijacking. However, exploitation requires that unsafe URL values are already stored in the database, which is prevented by standard model validation in forms and the admin interface. Therefore, the impact is limited to applications that persist URLField data without validation.

A fix is available in Django versions 5.2.17 and 6.0.8 and later. Users should upgrade to these or newer versions to remediate this vulnerability. Until upgraded, ensure that URLField data is always validated through model validation before being saved to the database to prevent unsafe URL schemes from being stored. Avoid direct database writes or bulk imports of untrusted URLField data without validation.