https://vulnerability.circl.lu/sightings/feed 2026-09-19T11:34:11.838951+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a115a80e-a214-4c55-b84c-51ac7b289808/export 2026-09-19T11:34:11.863180+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a115a80e-a214-4c55-b84c-51ac7b289808", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-61597", "type": "seen", "source": "https://gist.github.com/alon710/1b0e2f0ae4c11e6959d410c768da8b7e", "content": "# CVE-2026-61597: CVE-2026-61597: Cross-Site Scripting (XSS) via Unsanitized URI Schemes in djust Component Template Tags\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61597\n\n## Summary\nPrior to version 1.0.7, the djust Python package is vulnerable to Stored and Reflected Cross-Site Scripting (XSS) via component template tags. The underlying issue exists because the package fails to sanitize or validate incoming URI schemes when rendering URLs inside interactive HTML attributes like href or action. While the framework HTML-escapes strings to prevent attribute breakout, it permits the execution of arbitrary JavaScript via the javascript: pseudo-protocol.\n\n## TL;DR\nA vulnerability in djust (< 1.0.7) allows unauthenticated stored or reflected XSS because component template tags fail to validate URI schemes, allowing 'javascript:' payloads to execute directly upon user interaction.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 5.1\n- **EPSS Score**: 0.00%\n- **Impact**: Cross-Site Scripting (XSS)\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust Python package\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or higher\n- Implement strict URI schema validation at the application boundaries\n- Avoid directly rendering raw user inputs inside interactive attributes\n\n**Remediation Steps:**\n1. Identify installed djust version using 'pip show djust'\n2. Upgrade the package to '1.0.7' or newer using pip, poetry, or pipenv\n3. Audit components usage to ensure all URLs are verified\n\n## References\n\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [GitHub Security Advisory GHSA-4mf4-73j6-mvrw](https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw)\n- [National Vulnerability Database record for CVE-2026-61597](https://nvd.nist.gov/vuln/detail/CVE-2026-61597)\n- [CVE.org CVE-2026-61597 Record](https://www.cve.org/CVERecord?id=CVE-2026-61597)\n- [Wiz Vulnerability Database analysis for CVE-2026-61597](https://www.wiz.io/vulnerability-database/cve/cve-2026-61597)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61597) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T13:31:34.529621Z"} 2026-09-17T13:31:34.529621+00:00