CVE-2026-61597
CVE-2026-61597 is a Cross-site Scripting (XSS) vulnerability in djust. O3 Security confirms whether CVE-2026-61597 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Real-World Exposure
djustReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Many djust built-in component template tags (djust.components.templatetags.*) render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditional_escape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a javascript: URI (which needs no escapable characters), so a URL value of javascript:alert(document.cookie) lands verbatim in <a href="javascript:alert(document.cookie)"> and executes in the victim's session on click.
Affected sinks (executing href/action contexts; not exhaustive): breadcrumb (djust_components.py:1535; _advanced.py:1999,2022), dj_nav link/dropdown/brand (djust_components.py:5632,5779,5807,5830), citation URL (:6936), cookie-consent privacy link (:8240), error-page action (_advanced.py:1728), form action (_forms.py:1239). <img src> sinks are lower risk (javascript: does not execute via img src). No scheme validation exists anywhere in the component tags; a docstring at djust_components.py:781 even acknowledges the javascript: risk without mitigating it.
Severity Medium: XSS in the victim's authenticated session whenever an app renders one of these components with a URL sourced from user-controllable data; for href requires a click, worst case is the stored variant (URL persisted from one user, rendered to another). Conditional on developer usage, hence Medium rather than High.
Reproduced: breadcrumb(items=[{"label":"Home","url":"javascript:alert(document.cookie)"}]) emits <a ... href="javascript:alert(document.cookie)">Home</a>; JaVaScRiPt: case variant also passes; https:// URLs are preserved.
Patches
Add a safe_url() helper that neutralizes non-allowlisted schemes (javascript:, vbscript:, data:) to # while preserving http/https/mailto/tel/relative/anchor URLs, and route every href/action/formaction/xlink:href sink through it (then HTML-escape). Add a regression + an audit_ast/system-check rule flagging un-routed URL-attribute interpolation.
Workarounds
Do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.
References
Reproducer + finding writeup retained privately by the maintainer.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | djust | all versions | 1.0.7 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for djust. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update djust to 1.0.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-61597 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-61597 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-61597. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-61597 in your dependencies?
O3 detects CVE-2026-61597 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.