CVE-2026-61597: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in djust-org djust
### Impact Many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but **never validating the URL scheme**. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Affected sinks (executing href/action contexts; not exhaustive): breadcrumb (`djust_components.py:1535`; `_advanced.py:1999,2022`), `dj_nav` link/dropdown/brand (`djust_components.py:5632,5779,5807,5830`), citation URL (`:6936`), cookie-consent privacy link (`:8240`), error-page action (`_advanced.py:1728`), form `action` (`_forms.py:1239`). `<img src>` sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at `djust_components.py:781` even acknowledges the `javascript:` risk without mitigating it. **Severity Medium:** XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for `href` requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High. Reproduced: `breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}])` emits `<a ... href="javascript:alert(document.cookie)">Home</a>`; `JaVaScRiPt:` case variant also passes; `https://` URLs are preserved. ### Patches Add a `safe_url()` helper that neutralizes non-allowlisted schemes (`javascript:`, `vbscript:`, `data:`) to `#` while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an audit_ast/system-check rule flagging un-routed URL-attribute interpolation. ### Workarounds Do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments. ### References Reproducer + finding writeup retained privately by the maintainer.
AI Analysis
Technical Summary
The vulnerability in djust versions before 1.0.7 involves improper neutralization of input during web page generation (CWE-79). Specifically, djust's built-in component template tags escape user-supplied URLs for HTML but do not validate the URL scheme, allowing javascript: URIs to be injected and executed. This results in a cross-site scripting vulnerability where malicious JavaScript can run in the context of the victim's session upon clicking the crafted link. The issue is fixed in version 1.0.7.
Potential Impact
An attacker can inject a javascript: URI into href or action attributes rendered by djust components, leading to execution of arbitrary JavaScript in the victim's browser when the link is clicked. This can result in session hijacking or other client-side attacks. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited scope and impact.
Mitigation Recommendations
A fix is available in djust version 1.0.7. Users should upgrade to version 1.0.7 or later to remediate this vulnerability. As a temporary workaround, do not pass user-controllable URLs to the affected built-in component template tags. Alternatively, pre-validate URL schemes in application code to ensure only safe schemes (e.g., http, https) are used before binding URLs to component arguments.
CVE-2026-61597: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in djust-org djust
Description
### Impact Many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but **never validating the URL scheme**. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Affected sinks (executing href/action contexts; not exhaustive): breadcrumb (`djust_components.py:1535`; `_advanced.py:1999,2022`), `dj_nav` link/dropdown/brand (`djust_components.py:5632,5779,5807,5830`), citation URL (`:6936`), cookie-consent privacy link (`:8240`), error-page action (`_advanced.py:1728`), form `action` (`_forms.py:1239`). `<img src>` sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at `djust_components.py:781` even acknowledges the `javascript:` risk without mitigating it. **Severity Medium:** XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for `href` requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High. Reproduced: `breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}])` emits `<a ... href="javascript:alert(document.cookie)">Home</a>`; `JaVaScRiPt:` case variant also passes; `https://` URLs are preserved. ### Patches Add a `safe_url()` helper that neutralizes non-allowlisted schemes (`javascript:`, `vbscript:`, `data:`) to `#` while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an audit_ast/system-check rule flagging un-routed URL-attribute interpolation. ### Workarounds Do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments. ### References Reproducer + finding writeup retained privately by the maintainer.
CVSS v4.0
Score 5.1medium
Affected software
djust-org
djust
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in djust versions before 1.0.7 involves improper neutralization of input during web page generation (CWE-79). Specifically, djust's built-in component template tags escape user-supplied URLs for HTML but do not validate the URL scheme, allowing javascript: URIs to be injected and executed. This results in a cross-site scripting vulnerability where malicious JavaScript can run in the context of the victim's session upon clicking the crafted link. The issue is fixed in version 1.0.7.
Potential Impact
An attacker can inject a javascript: URI into href or action attributes rendered by djust components, leading to execution of arbitrary JavaScript in the victim's browser when the link is clicked. This can result in session hijacking or other client-side attacks. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited scope and impact.
Mitigation Recommendations
A fix is available in djust version 1.0.7. Users should upgrade to version 1.0.7 or later to remediate this vulnerability. As a temporary workaround, do not pass user-controllable URLs to the affected built-in component template tags. Alternatively, pre-validate URL schemes in application code to ensure only safe schemes (e.g., http, https) are used before binding URLs to component arguments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T17:12:17.238Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aab120555bf5e2cf536881e
Added to database: 09/16/2026, 22:02:45 UTC
Last enriched: 09/16/2026, 22:20:59 UTC
Last updated: 09/17/2026, 02:02:49 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.