{"id":"GHSA-4mf4-73j6-mvrw","summary":"djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags","details":"### Impact\nMany djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but **never validating the URL scheme**. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `\u003ca href=\"javascript:alert(document.cookie)\"\u003e` and executes in the victim's session on click.\n\nAffected sinks (executing href/action contexts; not exhaustive): breadcrumb (`djust_components.py:1535`; `_advanced.py:1999,2022`), `dj_nav` link/dropdown/brand (`djust_components.py:5632,5779,5807,5830`), citation URL (`:6936`), cookie-consent privacy link (`:8240`), error-page action (`_advanced.py:1728`), form `action` (`_forms.py:1239`). `\u003cimg src\u003e` sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at `djust_components.py:781` even acknowledges the `javascript:` risk without mitigating it.\n\n**Severity Medium:** XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for `href` requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High.\n\nReproduced: `breadcrumb(items=[{\"label\":\"Home\",\"url\":\"javascript:alert(document.cookie)\"}])` emits `\u003ca ... href=\"javascript:alert(document.cookie)\"\u003eHome\u003c/a\u003e`; `JaVaScRiPt:` case variant also passes; `https://` URLs are preserved.\n\n### Patches\nAdd a `safe_url()` helper that neutralizes non-allowlisted schemes (`javascript:`, `vbscript:`, `data:`) to `#` while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an audit_ast/system-check rule flagging un-routed URL-attribute interpolation.\n\n### Workarounds\nDo not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.\n\n### References\nReproducer + finding writeup retained privately by the maintainer.","aliases":["CVE-2026-61597"],"modified":"2026-09-16T22:00:04.819562472Z","published":"2026-09-16T21:50:53Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-16T21:50:53Z"},"references":[{"type":"WEB","url":"https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw"},{"type":"PACKAGE","url":"https://github.com/djust-org/djust"},{"type":"WEB","url":"https://github.com/djust-org/djust/releases/tag/v1.0.7"}],"affected":[{"package":{"name":"djust","ecosystem":"PyPI","purl":"pkg:pypi/djust"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7"}]}],"versions":["0.1.0","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.9.0","0.9.1","0.9.2","0.9.4","0.9.5","0.9.6","0.9.7","1.0.0","1.0.0rc1","1.0.0rc10","1.0.0rc11","1.0.0rc12","1.0.0rc13","1.0.0rc14","1.0.0rc15","1.0.0rc16","1.0.0rc17","1.0.0rc18","1.0.0rc2","1.0.0rc3","1.0.0rc4","1.0.0rc6","1.0.0rc7","1.0.0rc8","1.0.0rc9","1.0.1","1.0.1rc1","1.0.2","1.0.2rc1","1.0.2rc2","1.0.2rc3","1.0.3","1.0.3rc1","1.0.3rc2","1.0.4","1.0.4rc1","1.0.5","1.0.5rc1","1.0.5rc2","1.0.5rc3","1.0.5rc4","1.0.5rc5","1.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-4mf4-73j6-mvrw/GHSA-4mf4-73j6-mvrw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}