Description
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| liangliangyy | DjangoBlog | d186b1c53bac400a0c8a840f62a121d59880fe97 ≤6134ed63079de676b271af31de4dd40264d17c52 | — |
References
- https://vul.yulun.ac.cn/20261101/djangoblog/
- https://github.com/liangliangyy/DjangoBlog/issues/1030
- https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112
- https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76
- https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164
- https://www.vulncheck.com/advisories/djangoblog-commit-d186b1c-through-6134ed6-stored-xss-via-comment-reactions