CVE-2026-61597: 
Python vulnerability analysis and mitigation

CVE-2026-61597 is a stored/reflected Cross-Site Scripting (XSS) vulnerability in djust, a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance. The flaw affects all versions of djust prior to 1.0.7 and was first published on June 22, 2026, with the advisory added to the GitHub Advisory Database on September 16, 2026. Multiple built-in component template tags (djust.components.templatetags.*) render user-supplied URLs into href and action attributes without validating the URL scheme, allowing javascript: URIs to execute in victims' browsers. The vulnerability carries a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, GHSA Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): affected template tags apply Django's conditional_escape to user-supplied URLs, which prevents HTML attribute breakout but does not neutralize javascript: URIs since they contain no characters requiring HTML escaping. Affected sinks include breadcrumb links (djust_components.py:1535; _advanced.py:1999,2022), navigation links/dropdowns/brand (djust_components.py:5632,5779,5807,5830), citation URLs (:6936), cookie-consent privacy links (:8240), error-page actions (_advanced.py:1728), and form actions (_forms.py:1239). Notably, a docstring at djust_components.py:781 acknowledged the javascript: risk without implementing any mitigation. Case variants such as JaVaScRiPt: also bypass the non-existent scheme validation, and exploitation requires only that a low-privileged user can supply a URL value that is later rendered to another user (GitHub Advisory, GHSA Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the authenticated session of any victim who clicks a maliciously crafted link rendered by an affected component. The worst-case scenario is the stored variant, where a malicious URL persisted by one user is rendered to other users, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of the victim. While the vulnerable system itself has no direct confidentiality or integrity impact, the subsequent system impact includes low-level confidentiality and integrity compromise (e.g., cookie exfiltration, DOM manipulation) (GitHub Advisory, GHSA Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the advisory date. The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged attacker who can supply a URL to an affected component, plus passive user interaction (a victim clicking the link), limiting the attack surface to applications that pass user-controllable URLs to djust's built-in component tags (GitHub Advisory).

1. Identify a target application: Locate a Django application using djust (pip package) version < 1.0.7 that renders user-supplied URLs through built-in component template tags such as breadcrumbs, navigation links, forms, or error pages.
2. Supply a malicious URL: As a low-privileged authenticated user, submit a javascript: URI as a URL value to an affected component — for example, providing javascript:alert(document.cookie) as a breadcrumb item URL or form action URL via any user-controllable input field.
3. Trigger rendering: Ensure the malicious URL is stored (stored XSS) or reflected in a page rendered to other users. For example: breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}]) emits <a href="javascript:alert(document.cookie)">Home</a>.
4. Bypass case-sensitivity checks: If any application-level filtering exists, use mixed-case variants such as JaVaScRiPt:alert(document.cookie) to evade naive string matching.
5. Achieve payload execution: When a victim (e.g., another authenticated user or administrator) clicks the rendered link, the javascript: URI executes in their browser session, enabling cookie theft, session hijacking, or further malicious actions (GitHub Advisory, GHSA Advisory).

• Logs: Web server or Django application logs showing URL parameters or form fields containing javascript:, vbscript:, or data: scheme strings submitted to endpoints that feed djust component tags.
• Database/Storage: Stored records (e.g., breadcrumb items, navigation entries, form action fields) containing javascript: or mixed-case variants like JaVaScRiPt: in URL fields.
• Network: Outbound requests from victim browsers to attacker-controlled infrastructure (e.g., cookie exfiltration endpoints) originating shortly after page loads containing djust-rendered components.
• Browser/Client: Unexpected JavaScript execution alerts or console errors triggered on pages rendering djust breadcrumb, navigation, form, or error-page components with user-supplied URL data (GitHub Advisory).

Upgrade djust to version 1.0.7, which introduces a safe_url() helper that neutralizes non-allowlisted schemes (javascript:, vbscript:, data:) by replacing them with #, while preserving http, https, mailto, tel, relative, and anchor URLs. All href, action, formaction, and xlink:href sinks are routed through this helper before HTML escaping. As a workaround for those unable to upgrade immediately, do not pass user-controllable URLs to the affected built-in component tags, and pre-validate URL schemes in application code before binding them to component arguments (GitHub Advisory, v1.0.7 Release).