CVE-2026-129156 · Package
NO FIX YET
DjangoBlog does not escape an OAuth user's nickname when rendering comment reactions, so a crafted display name breaks out of an HTML attribute. An attacker can then run script in the browsers of visitors who view the article.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running DjangoBlog code from the affected commit range that allow OAuth login and comment reactions. The flaw needs an authenticated OAuth user to set the malicious nickname, then a reaction on a comment; sites without OAuth or reactions are not reached through this path. The sources do not give a fixed version.
Not affected if no-oauth-login, outside-commit-range, reactions-disabled
Who cares django, djangoblog, oauth, self-hosted
d186b1c and commit 6134ed6, for example with git log --oneline in the project directory.No fix yet, per the sources.
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.