Threats affecting pkg:github/DjangoBlog

DjangoBlog versions 2.0.0.0 through 2.1.0.0 are affected by a stored cross-site scripting (XSS) vulnerability. The issue arises because the comment sanitizer improperly allows event-handler attributes such as autofocus and onfocus on certain HTML tags. Authenticated users can exploit this by posting specially crafted comments that execute scripts automatically when viewed by others, including administrators.

CVE-2026-129156 is a stored cross-site scripting (XSS) vulnerability in DjangoBlog versions between commits d186b1c and 6134ed6. Authenticated OAuth users can exploit this flaw by setting their OAuth display name to a malicious script payload that closes a single-quoted attribute in comment reactions. When such a user reacts to a comment, the injected script executes in the browsers of visitors viewing the article.