CVE-2026-129156
DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.
| CWE | CWE-79 |
| Vendor | liangliangyy |
| Product | djangoblog |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for liangliangyy djangoblog
Be the first to know when new medium vulnerabilities affecting liangliangyy djangoblog are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
liangliangyy / DjangoBlog
d186b1c53bac400a0c8a840f62a121d59880fe97 ≤ 6134ed63079de676b271af31de4dd40264d17c52
References
vul.yulun.ac.cn: https://vul.yulun.ac.cn/20261101/djangoblog/ github.com: https://github.com/liangliangyy/DjangoBlog/issues/1030 github.com: https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112 github.com: https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76 github.com: https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164 vulncheck.com: https://www.vulncheck.com/advisories/djangoblog-commit-d186b1c-through-6134ed6-stored-xss-via-comment-reactions
Credits
Wu Yulun