Threats Tagged 'cwe-83'

CVE-2026-15920 is a cross-site scripting (XSS) vulnerability in Django affecting versions 5.2 before 5.2.17 and 6.0 before 6.0.8. The issue arises because the admin utility display_for_field() renders URLField values as clickable links without validating the URL scheme. Unsafe URL schemes stored in the database can lead to XSS attacks against staff users who click these links. Exploitation requires that unsafe URL values are already present in the database, which can occur if data is inserted without proper model validation, such as via direct database writes or bulk imports.

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.