CVE-2026-61597: Djust URLs Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4mf4-73j6-mvrw",
  "modified" : "2026-09-16T21:50:53Z",
  "published" : "2026-09-16T21:50:53Z",
  "aliases" : [ "CVE-2026-61597" ],
  "summary" : "djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags",
  "details" : "### Impact\nMany djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but **never validating the URL scheme**. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href=\"javascript:alert(document.cookie)\">` and executes in the victim's session on click.\n\nAffected sinks (executing href/action contexts; not exhaustive): breadcrumb (`djust_components.py:1535`; `_advanced.py:1999,2022`), `dj_nav` link/dropdown/brand (`djust_components.py:5632,5779,5807,5830`), citation URL (`:6936`), cookie-consent privacy link (`:8240`), error-page action (`_advanced.py:1728`), form `action` (`_forms.py:1239`). `<img src>` sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at `djust_components.py:781` even acknowledges the `javascript:` risk without mitigating it.\n\n**Severity Medium:** XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for `href` requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High.\n\nReproduced: `breadcrumb(items=[{\"label\":\"Home\",\"url\":\"javascript:alert(document.cookie)\"}])` emits `<a ... href=\"javascript:alert(document.cookie)\">Home</a>`; `JaVaScRiPt:` case variant also passes; `https://` URLs are preserved.\n\n### Patches\nAdd a `safe_url()` helper that neutralizes non-allowlisted schemes (`javascript:`, `vbscript:`, `data:`) to `#` while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an audit_ast/system-check rule flagging un-routed URL-attribute interpolation.\n\n### Workarounds\nDo not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.\n\n### References\nReproducer + finding writeup retained privately by the maintainer.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "djust"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.7"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/djust-org/djust"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/djust-org/djust/releases/tag/v1.0.7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-16T21:50:53Z",
    "nvd_published_at" : null
  }
}