Loading story…
A reflected cross-site scripting risk was highlighted in Django applications that include request.method in HttpResponseBadRequest output. Because HTTP/1.1 allows custom request methods, an attacker can supply an arbitrary verb that Django normalizes to uppercase, turning the HTTP method into an unexpected user-controlled input source that may be reflected into HTML error responses.
The report showed that, despite constraints such as forced uppercase and the inability to use spaces, crafted payloads can still produce exploitable markup, including malicious anchor tags. Browser-based exploitation is more limited because XMLHttpRequest and the Fetch API restrict unusual characters in HTTP verbs, but the pattern remains unsafe; defenders were advised to avoid reflecting request.method in responses and to use Semgrep rules to detect this Django anti-pattern.
See affected versions and whether adversaries are exploiting it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Django has patched **CVE-2026-15920**, a moderate-severity stored cross-site scripting flaw in the admin interface caused by unsafe rendering of `URLField` values. In affected versions, admin changelist views and read-only fields could automatically display stored URLs as clickable links without validating the scheme, allowing attacker-controlled values such as `javascript:` or `data:` to appear as executable links in the admin panel. The fix adds `URLValidator` checks before rendering `URLField` values as anchors and falls back to plain-text output when validation fails, preventing unsafe schemes from being turned into links. The patch also includes tests to verify that malicious URL values are no longer rendered as anchor tags, and the issue is reported as fixed in **Django 6.0.8** and **5.2.17**.
Aug 5, 2026
Multiple web application vulnerabilities have been disclosed, highlighting the risks associated with misconfigured APIs and file upload functionalities. One report demonstrates how a misconfigured GraphQL endpoint, which accepts `application/x-www-form-urlencoded` content types, can be exploited for Cross-Site Request Forgery (CSRF) attacks. Attackers can craft malicious HTML forms to submit GraphQL mutations, such as changing user email addresses, without proper user consent. Another case details a $100 bug bounty awarded for discovering XSS via malicious PDF uploads and input validation bypasses that led to denial-of-service conditions on a coding platform. Further research describes a blind XML External Entity (XXE) vulnerability in a "Check stock" feature, where attackers can trigger out-of-band DNS and HTTP requests using Burp Collaborator, confirming the presence of XXE. Additionally, a $1,500 bounty was awarded for exploiting an image upload feature at Rockstar Games, where a vulnerable ImageMagick instance enabled a chain of attacks including Local File Inclusion (LFI), Server-Side Request Forgery (SSRF), and remote file access via SMB paths. These incidents underscore the importance of strict input validation, secure API configurations, and careful handling of file uploads in web applications.
Jun 29, 2026
Django issued security releases `5.2.9`, `5.1.15`, and `4.2.27` to fix **CVE-2025-64460**, a denial-of-service vulnerability in the framework's XML deserialization logic. The flaw is rooted in `django.core.serializers.xml_serializer.getInnerText()`, where specially crafted XML can trigger excessive CPU and memory consumption, allowing a remote attacker to exhaust resources and disrupt affected applications. The issue was reported by Seokchan Yoon and affects supported Django branches before those patched versions; unsupported branches including `5.0.x`, `4.1.x`, and `3.2.x` were not evaluated and may also be exposed. Red Hat classified the bug as **Important** with a CVSS v3.1 score of `7.5` and said no acceptable mitigation was available at publication, making patching the primary response. The company warned that products using Django's XML Deserializer may be affected, including **Red Hat Ansible Automation Platform**, **Red Hat OpenStack Platform**, and **OpenShift Service Mesh**, and published fixes for multiple Ansible Automation Platform releases through advisories `RHSA-2026:1249`, `RHSA-2026:1497`, and `RHSA-2026:1506`.
Aug 20, 2026