CVE-2026-75526: 
Python vulnerability analysis and mitigation

CVE-2026-75526 is a stored Cross-Site Scripting (XSS) vulnerability in django CMS affecting versions >= 5.0.8 and < 5.0.9. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled stored values — including the exception message, get_short_description() output, placeholder string, and placeholder.source — directly into an HTML heading without escaping, then returns the result via mark_safe. This allows a low-privileged user who can store HTML in plugin fields to execute arbitrary JavaScript in a staff editor's browser. The vulnerability was originally published on July 10, 2026, and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 4.4 (Moderate) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). In the vulnerable code path, ContentRenderer.render_placeholder catches plugin rendering exceptions and calls render_exception(), which constructs a heading using an f-string: heading = f'{message}'. Because message can incorporate stored user-controlled data (from get_short_description(), str(placeholder), or str(placeholder.source) such as a page title), and the final output is passed through mark_safe, Django's template autoescaping is bypassed entirely. The settings.DEBUG flag does not mitigate the issue — it only controls whether Django's traceback HTML is appended, while the custom heading is always rendered in edit mode. The fix replaces the f-string with heading = format_html('{}', message), which properly HTML-escapes the interpolated value before marking the output safe (Github Advisory, Fix Commit).

Successful exploitation allows a low-privileged attacker who can store HTML content in plugin model fields (e.g., a page title or plugin short description) to execute arbitrary JavaScript in the browser of any staff user who views the affected page in edit mode. The scope is changed (S:C), meaning the XSS payload executes in the context of the staff user's session, potentially enabling session hijacking, credential theft, unauthorized CMS actions, or further privilege escalation within the CMS. Confidentiality and integrity impacts are both rated Low, and there is no availability impact (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have low-level privileges (e.g., the ability to edit plugin fields), and a staff user must interact with the affected page in edit mode, making automated exploitation unlikely. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (Github Advisory).

1. Gain low-privileged access: Obtain a CMS account with permission to edit plugin fields (e.g., an author or editor role with access to at least one plugin whose fields are reflected in get_short_description() or in the page title/source).
2. Inject XSS payload: Store a malicious HTML payload in a plugin field that is included in get_short_description(), or in a page title (which becomes str(placeholder.source)). For example, set a page title to <img src=x onerror=alert(1)> or embed a script tag in a plugin's text field.
3. Trigger a plugin rendering exception: Ensure the targeted plugin raises an exception during edit-mode rendering. This may occur naturally due to misconfiguration, or may be engineered by manipulating plugin data to cause a runtime error.
4. Wait for staff user interaction: When a staff user with higher privileges opens the affected page in CMS edit mode, ContentRenderer.render_placeholder catches the exception and calls render_exception(), which interpolates the stored payload into the unescaped heading.
5. Payload executes: The stored HTML/JavaScript executes in the staff user's browser within the CMS editing context, enabling session token theft, unauthorized CMS actions, or further attacks (Github Advisory, Fix Commit).

• Logs: CMS access logs showing edit-mode page loads (?edit query parameter) on pages with plugins that have recently had their short description or source fields modified with HTML content; Django error logs showing plugin rendering exceptions (cms.plugin_rendering ERROR level) coinciding with suspicious field values.
• File System / Database: Plugin model fields or page titles containing HTML tags such as <script>, <img src=x onerror=...>, or other event-handler attributes stored in the database.
• Network: Outbound requests from staff browsers to unexpected external domains immediately after loading CMS edit-mode pages, which may indicate XSS payload beaconing or session token exfiltration.
• Process / Application: Unexpected CMS administrative actions (plugin additions, permission changes, content modifications) performed under a staff user's session that the user did not initiate, potentially indicating session hijacking following XSS execution (Github Advisory).

Upgrade django CMS to version 5.0.9, which replaces the vulnerable f-string interpolation with format_html('{}', message) to properly escape user-controlled content before it is marked safe (5.0.9 Release, Fix Commit). As a partial workaround prior to patching, restrict plugin editing permissions so that only fully trusted staff can modify fields included in get_short_description(), and disable or fix any plugins that can be made to raise exceptions during edit-mode rendering. Note that this workaround does not eliminate the underlying escaping bug and should not be considered a complete mitigation (Github Advisory).

The vulnerability was reported by security researcher meifukun and fixed by django CMS maintainer fsbraun. The advisory was published to the GitHub Advisory Database on August 20, 2026, and the fix was included in the django CMS 5.0.9 release on July 10, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Github Advisory).