DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions

Advisories

DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions

Severity: medium
Date: 11/13/2026
Affecting: DjangoBlog >= d186b1c53bac400a0c8a840f62a121d59880fe97, <= 6134ed63079de676b271af31de4dd40264d17c52
CVE: CVE-2026-129156
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: https://vul.yulun.ac.cn/20261101/djangoblog/
https://github.com/liangliangyy/DjangoBlog/issues/1030
https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112
https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76
https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164
Credit: Wu Yulun
Description: DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo