What is CVE-2026-61597?

CVE-2026-61597 is a medium-severity cross-site scripting (XSS) vulnerability in djust (pip), affecting versions < 1.0.7. It is fixed in 1.0.7. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.

Which versions of djust are affected by CVE-2026-61597?

djust (pip) versions < 1.0.7 is affected.

Is there a fix for CVE-2026-61597?

Yes. CVE-2026-61597 is fixed in 1.0.7. Upgrade to this version or later.

Is CVE-2026-61597 exploitable, and should I be worried?

Whether CVE-2026-61597 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-61597 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-61597?

Upgrade djust to 1.0.7 or later.

CVE-2026-61597 in djust

Q: Which versions of djust are affected by CVE-2026-61597?

djust (pip) versions < 1.0.7 is affected.

Q: Is there a fix for CVE-2026-61597?

Yes. CVE-2026-61597 is fixed in 1.0.7. Upgrade to this version or later.

Q: Is CVE-2026-61597 exploitable, and should I be worried?

Whether CVE-2026-61597 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-61597 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-61597?

Upgrade djust to 1.0.7 or later.

Summary

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Workarounds

Do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.

References

Reproducer + finding writeup retained privately by the maintainer.

Impact

Many djust built-in component template tags (djust.components.templatetags.*) render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditional_escape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a javascript: URI (which needs no escapable characters), so a URL value of javascript:alert(document.cookie) lands verbatim in <a href="javascript:alert(document.cookie)"> and executes in the victim's session on click.

Affected sinks (executing href/action contexts; not exhaustive): breadcrumb (djust_components.py:1535; _advanced.py:1999,2022), dj_nav link/dropdown/brand (djust_components.py:5632,5779,5807,5830), citation URL (:6936), cookie-consent privacy link (:8240), error-page action (_advanced.py:1728), form action (_forms.py:1239). <img src> sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at djust_components.py:781 even acknowledges the javascript: risk without mitigating it.

Severity Medium: XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for href requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High.

Reproduced: breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}]) emits <a ... href="javascript:alert(document.cookie)">Home</a>; JaVaScRiPt: case variant also passes; https:// URLs are preserved.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Affected versions

djust (< 1.0.7)

Security releases

djust → 1.0.7 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Add a safe_url() helper that neutralizes non-allowlisted schemes (javascript:, vbscript:, data:) to # while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an audit_ast/system-check rule flagging un-routed URL-attribute interpolation.

Frequently Asked Questions

What is CVE-2026-61597? CVE-2026-61597 is a medium-severity cross-site scripting (XSS) vulnerability in djust (pip), affecting versions < 1.0.7. It is fixed in 1.0.7. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
Which versions of djust are affected by CVE-2026-61597? djust (pip) versions < 1.0.7 is affected.
Is there a fix for CVE-2026-61597? Yes. CVE-2026-61597 is fixed in 1.0.7. Upgrade to this version or later.
Is CVE-2026-61597 exploitable, and should I be worried? Whether CVE-2026-61597 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-61597 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-61597? Upgrade djust to 1.0.7 or later.