CVE-2026-75526 json
django CMS: Stored XSS in edit-mode plugin exception rendering
published 2026-08-20 2 mo ago modified 2026-10-26 14 d ago also EUVD-2026-63571 , GHSA-hvq6-2r72-p2x7 , PYSEC-2026-3825
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.
Patch / fix
- pypi django-cms 5.0.9
- django-cms django_cms 5.0.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | django-cms | >=5.0.8, <5.0.9 |
5.0.9 |
Affected products
- django-cms django-cms
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/django-cms/django-cms/pull/8711
web
-
github.com
/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88
web
-
github.com
/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7
web
-
github.com
/django-cms/django-cms/releases/tag/5.0.9
web
-
github.com
/django-cms/django-cms
package
-
pypi.org
/project/django-cms
package
-
github.com
/advisories/GHSA-hvq6-2r72-p2x7
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-75526
advisory
Sources
- CVE List CVE-2026-75526
- GitHub Advisory GHSA-hvq6-2r72-p2x7
- NVD CVE-2026-75526
- OSV PYSEC-2026-3825
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.