CVE-2026-129156

CVSS 5.4 (medium) · published 2026-11-13

DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.

Weakness: CWE-79

Source: NVD CVE-2026-129156

References

• https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164
• https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112
• https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76
• https://github.com/liangliangyy/DjangoBlog/issues/1030
• https://vul.yulun.ac.cn/20261101/djangoblog/
• https://www.vulncheck.com/advisories/djangoblog-commit-d186b1c-through-6134ed6-stored-xss-via-comment-reactions

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.