GHSA-cqpq-mfhw-4pgqMediumCVSS 5.4
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting...
🔗 CVE IDs covered (1)
📋 Description
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129156
- https://github.com/liangliangyy/DjangoBlog/issues/1030
- https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164
- https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112
- https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76
- https://vul.yulun.ac.cn/20261101/djangoblog
- https://www.vulncheck.com/advisories/djangoblog-commit-d186b1c-through-6134ed6-stored-xss-via-comment-reactions
- https://github.com/advisories/GHSA-cqpq-mfhw-4pgq