Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-20T19:17:03.787Z",
  "pubdate": "2026-08-20T19:17:03.787Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in django CMS versions 5.0.8 through 5.0.9, specifically within the plugin rendering component. The flaw allows stored, attacker-controlled values to be passed insecurely to exception-handling routines when plugin rendering fails in edit mode.\nThe impact of this vulnerability involves the execution of arbitrary HTML and JavaScript in an editor's browser session. An attacker with privileges to store crafted payloads can compromise authenticated user sessions, leading to potential privilege escalation or unauthorized administrative actions within the affected content management system.\nThe vulnerability affects django CMS versions 5.0.8 up to 5.0.9. Exploitation requires the attacker to inject malicious content that triggers an exception during plugin rendering while an editor views the page in edit mode. The application fails to sanitize interpolated values before marking them as safe, and settings.DEBUG does not mitigate the custom rendering exception heading.",
  "technicalDetails": "The root cause of the vulnerability resides in cms/plugin_rendering.py, specifically within the ContentRenderer.render_placeholder function. When plugin rendering fails in edit mode, this function passes stored, attacker-controlled values to ContentRenderer.render_exception.\nThe vulnerable component interpolates values derived from get_short_description(), the exception message, the placeholder, or placeholder.source directly into a cms-rendering-exception heading without proper sanitization. These unsanitized values are subsequently returned to the client through the use of the mark_safe function, bypassing Django's automatic template escaping mechanisms.\nBecause the resulting heading is rendered without escaping, any stored HTML or JavaScript payload contained within the exception parameters executes within the context of an editor's browser when the placeholder is processed. The presence of settings.DEBUG does not prevent this custom rendering exception heading from displaying and executing the injected payload.\nThe attack flow proceeds as follows: 1) An attacker injects a malicious payload into a vector that influences plugin rendering parameters, such as a placeholder or plugin metadata. 2) The application attempts to render the plugin in edit mode, triggering a rendering failure. 3) ContentRenderer.render_placeholder captures the failure and forwards the stored attacker-controlled values to ContentRenderer.render_exception. 4) The values are interpolated into the unescaped cms-rendering-exception heading. 5) The output is marked safe via mark_safe and returned to the browser. 6) When an editor views the page, the browser executes the stored payload in the security context of the victim's session."
}