CVE-2020-15118: 
Python vulnerability analysis and mitigation

CVE-2020-15118 affects Wagtail versions before 2.7.4 and 2.9.3, where HTML injection was possible through form field help text in the wagtail.contrib.forms form builder app. The vulnerability was discovered and disclosed on July 20, 2020 (GitHub Advisory).

When a form page type is made available to Wagtail editors through the wagtail.contrib.forms app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used within a form field's help text would be rendered unescaped in the page. While allowing HTML within help text is an intentional design decision by Django, Wagtail's policy is to not allow editors to insert arbitrary HTML by default to prevent potential cross-site scripting attacks (GitHub Advisory).

The vulnerability could potentially be used to carry out cross-site scripting attacks, including privilege escalation. However, the vulnerability is not exploitable by ordinary site visitors without access to the Wagtail admin interface (GitHub Advisory).

Patched versions have been released as Wagtail 2.7.4 (for the LTS 2.7 branch) and Wagtail 2.9.3 (for the current 2.9 branch). In these versions, help text is escaped by default to prevent the inclusion of HTML tags. Site owners who wish to re-enable HTML in help text can set WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True in their configuration settings. For those unable to upgrade, forms can be secured by rendering them field-by-field as per Django's documentation, omitting the |safe filter when outputting help text (GitHub Advisory).