DJANGOBLOG · CVE-2026-129155 · Package
NO FIX YET
DjangoBlog versions 2.0.0.0 through 2.1.0.0 have a comment sanitizer that keeps event-handler attributes on span, div, pre and code tags. An authenticated commenter can post markup that runs script in every visitor's browser, including administrators.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running DjangoBlog in the affected version range that accept comments from users. Exposure needs a commenter account, and the stored payload fires for every visitor who views the comment, including administrators. Sites that disable comments or run a different version can skip it.
Not affected if comments-disabled, other-version
Who cares django, djangoblog, self-hosted
2.0.0.0 through 2.1.0.0class_filter comment sanitizer in the codebase for allowed event-handler attributes on span, div, pre and codeNo fix yet, per the sources.
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.