{"id":"CVE-2026-129155","kind":"vulnerability","aliases":["CVE-2026-129155"],"related":[],"title":"DjangoBlog: stored XSS in comments lets commenters run script","description":"DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.","summary":"DjangoBlog versions 2.0.0.0 through 2.1.0.0 have a comment sanitizer that keeps event-handler attributes on span, div, pre and code tags. An authenticated commenter can post markup that runs script in every visitor's browser, including administrators.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DjangoBlog","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["django","djangoblog","package","self-hosted"],"not_affected_if":["comments-disabled","other-version"],"how_to_check":"- Confirm the installed DjangoBlog version falls in `2.0.0.0` through `2.1.0.0`\n- Review the `class_filter` comment sanitizer in the codebase for allowed event-handler attributes on span, div, pre and code","fix":null,"status":"open","published_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:53+00:00","updated_at":"2026-11-13T18:51:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T18:51:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DjangoBlog: stored XSS in comments lets commenters run script","impact":"medium","summary":"DjangoBlog versions 2.0.0.0 through 2.1.0.0 have a comment sanitizer that keeps event-handler attributes on span, div, pre and code tags. An authenticated commenter can post markup that runs script in every visitor's browser, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["django","djangoblog","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in admin browsers, enabling account takeover","analyst_note":"","how_to_check":"- Confirm the installed DjangoBlog version falls in `2.0.0.0` through `2.1.0.0`\n- Review the `class_filter` comment sanitizer in the codebase for allowed event-handler attributes on span, div, pre and code","plain_action":"","product_name":"DjangoBlog","needs_analyst":false,"not_affected_if":["comments-disabled","other-version"],"who_is_affected":"Sites running DjangoBlog in the affected version range that accept comments from users. Exposure needs a commenter account, and the stored payload fires for every visitor who views the comment, including administrators. Sites that disable comments or run a different version can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000725,"input_tokens":4608,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129155':12A,15A '-2026':11A,14A '2.0.0.0':25B,62C '2.1.0.0':27B,64C 'administr':60B,110C 'attribut':37B,83C,101C 'authent':46B,91C 'autofocus':98C 'browser':58B 'class':75C 'code':43B,89C 'comment':5A,7A,30B,47B,77C,92C 'contain':65C 'cross':69C 'cross-sit':68C 'cve':10A,13A 'div':40B,86C,96C 'django':17B 'djangoblog':1A,16A,18B,23B,61C 'event':35B,81C 'event-handl':34B,80C 'everi':55B,107C 'execut':102C 'filter':76C 'handler':36B,82C 'host':22B 'includ':59B,109C 'interact':105C 'keep':33B 'let':6A 'markup':50B 'onfocus':100C 'packag':19B 'pass':79C 'post':49B,94C 'pre':41B,87C 'run':8A,52B 'sanit':31B,78C 'script':9A,53B,71C,103C 'self':21B 'self-host':20B 'site':70C 'span':39B,85C 'store':2A,67C 'tag':44B,90C 'version':24B 'visitor':56B,108C 'vulner':72C 'without':104C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running DjangoBlog in the affected version range that accept comments from users. Exposure needs a commenter account, and the stored payload fires for every visitor who views the comment, including administrators. Sites that disable comments or run a different version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["djangoblog"],"ptokens":["djangoblog"],"labels":["django","djangoblog","medium","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-129155':12A,15A '-2026':11A,14A 'comment':5A,7A 'cve':10A,13A 'djangoblog':1A,16A 'let':6A 'run':8A 'script':9A 'store':2A 'xss':3A","search_b":"'2.0.0.0':25B '2.1.0.0':27B 'administr':60B 'attribut':37B 'authent':46B 'browser':58B 'code':43B 'comment':30B,47B 'div':40B 'django':17B 'djangoblog':18B,23B 'event':35B 'event-handl':34B 'everi':55B 'handler':36B 'host':22B 'includ':59B 'keep':33B 'markup':50B 'packag':19B 'post':49B 'pre':41B 'run':52B 'sanit':31B 'script':53B 'self':21B 'self-host':20B 'span':39B 'tag':44B 'version':24B 'visitor':56B","search_c":"'2.0.0.0':62C '2.1.0.0':64C 'administr':110C 'attribut':83C,101C 'authent':91C 'autofocus':98C 'class':75C 'code':89C 'comment':77C,92C 'contain':65C 'cross':69C 'cross-sit':68C 'div':86C,96C 'djangoblog':61C 'event':81C 'event-handl':80C 'everi':107C 'execut':102C 'filter':76C 'handler':82C 'includ':109C 'interact':105C 'onfocus':100C 'pass':79C 'post':94C 'pre':87C 'sanit':78C 'script':71C,103C 'site':70C 'span':85C 'store':67C 'tag':90C 'visitor':108C 'vulner':72C 'without':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129155","severity":null,"published_at":"2026-11-13T18:17:40+00:00","modified_at":"2026-11-13T18:17:40+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null}],"documents":[{"id":148613,"url":"https://www.vulncheck.com/advisories/djangoblog-2.0.0.0-through-2.1.0.0-stored-xss-via-comment-sanitizer-class-filter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}