Django Flaws Let Attackers Trigger RCE, SSRF, DoS, and XSS Attacks

The Django project has released security updates, specifically Django 6.0.8 and Django 5.2.17, to address four vulnerabilities that could lead to server-side request forgery (SSRF), arbitrary file writes with potential for remote code execution (RCE), denial-of-service (DoS), and stored cross-site scripting (XSS) attacks.

An advisory posted by Natalia Bidart on August 4, 2026, urges all users of supported Django branches to upgrade promptly. Patches have also been applied to Django’s main branch and the 6.1 release candidate.

Django Flaws

The most critical issue, tracked as CVE-2026-15307, affects Django’s Geographic Information System (GeoDjango) spatial lookups.

This flaw allowed string and dictionary values representing raster data to be passed to GDALRaster. Depending on the installed raster driver and configuration, this behavior could result in the Django process writing files to disk or initiating outbound network requests.

In some environments, an attacker could potentially exploit an arbitrary file write to achieve remote code execution. This vulnerability was accessible through Django admin changelists, where staff users with view permissions on a registered model containing a spatial field could supply crafted lookup parameters.

To mitigate the vulnerability CVE-2026-15307, Django now blocks dictionary values and strings that are not valid GEOSGeometry objects from being used in spatial lookups.

This change is backward-incompatible for applications that rely on serialized dictionaries or similar values in lookups.

Django emphasized that direct model-field assignments remain unchanged and still accept these formats, but developers should validate any untrusted spatial input before processing it.

The project rates this issue as high severity and credits Bence Nagy, localhost-detect, and kimchunbok_ for reporting it.

Django also addressed two denial-of-service vulnerabilities. CVE-2026-15337 affects the function django.utils.translation.check_for_language(), which could consume excessive process memory when handling numerous unique, lengthy language codes.

Such values could be submitted through POST data to the optional django.views.i18n.set_language() endpoint. Although Django stated that request-size restrictions and cache limits limited the potential impact, the update now rejects language codes that exceed 500 characters before they enter the cache lookup. The vulnerability is rated as low severity.

CVE-2026-15830, rated as moderate severity, concerns deeply nested GEOMETRYCOLLECTION objects processed by GEOSGeometry. A maliciously crafted geometry could cause a segmentation fault in the GEOS library, interrupting the application process.

As a response, Django now enforces limits of 198 nested geometry collections for Well-Known Text (WKT) inputs and 198 total collections for Well-Known Binary (WKB) inputs.

Administrators can adjust this threshold using the new max_geom_collections argument. GeoJSON is not affected because it is parsed via GDAL rather than the vulnerable GEOS path.

Lastly, CVE-2026-15920 addresses a moderate-severity stored XSS risk in Django admin views. Previously, values in URLField were rendered as clickable links in changelists and read-only fields without ensuring that the scheme was safe.

Django has now implemented validation checks using URLValidator; invalid URLs are displayed as plain text instead. Organizations using Django versions 6.0 or 5.2 should upgrade to 6.0.8 or 5.2.17 immediately and review their administrative access, GIS lookup usage, and exposed admin interfaces.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world