Description
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1:1.9.8-1 | — |
| Debian 13 | python-django | 1:1.9.8-1 | — |
| Debian 12 | python-django | 1:1.9.8-1 | — |
| Debian 8 | python-django | 1.7.7-1+deb8u5 | DSA-3622-1 |
| Debian 7 | python-django | 1.4.5-1+deb7u17 | DLA-555-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-django | 1.8.7-1ubuntu5.1 | USN-3039-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-optools 8 | python-django +1 | 1.8.14-1.el7ost | RHSA-2016:1594 |
| Red Hat OpenStack 8 | python-django +1 | 1.8.14-1.el7ost | RHSA-2016:1596 |
| Red Hat OpenStack 7 | python-django +2 | 1.8.14-1.el7ost | RHSA-2016:1595 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting EDB-40129 · webapps · Jul 20, 2016 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.8.14 | 1.8.14 | GHSA-c8c8-9472-w52h |
| PyPI | django | >= 1.9, < 1.9.8 | 1.9.8 | GHSA-c8c8-9472-w52h |
| PyPI | django | >= 1.10a1, < 1.10rc1 | 1.10rc1 | GHSA-c8c8-9472-w52h |
| PyPI | django | < 1.8.14 · >= 1.9, < 1.9.8 · >= 1.10a0, < 1.10rc1 | 1.8.14, 1.9.8, 1.10rc1 | PYSEC-2016-2 |
Advisories 6
- RHSA-2016:1595 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1596 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1594 Red Hat Security Advisory: python-django security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-555-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3622-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3039-1 python-django vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
References
- 1036338 vdb-entry
- 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186) mailing-list
- RHSA-2016:1594 vendor-advisory
- DSA-3622 vendor-advisory
- FEDORA-2016-97ca9d52a4 vendor-advisory
- http://www.vulnerability-lab.com/get_content.php?id=1869
- 20160719 Django CMS v3.3.0 - (Editor Snippet) Persistent Web Vulnerability (CVE-2016-6186) mailing-list
- http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html
- USN-3039-1 vendor-advisory
- FEDORA-2016-b7e31a0b9a vendor-advisory
- https://github.com/django/django/commit/f68e5a99164867ab0e071a936470958ed867479d
- RHSA-2016:1596 vendor-advisory
- https://www.djangoproject.com/weblog/2016/jul/18/security-releases/
- https://github.com/django/django/commit/d03bf6fe4e9bf5b07de62c1a271c4b41a7d3d158
- 92058 vdb-entry
- RHSA-2016:1595 vendor-advisory
- 40129 exploit