CyberRota Analysis
AI-GeneratedThe vulnerability affects django CMS versions 5.0.8 to 5.0.9, where the ContentRenderer can inadvertently execute attacker-controlled HTML when rendering plugin errors in edit mode. This can lead to cross-site scripting (XSS) attacks, allowing malicious scripts to execute in the browser of an editor. Organizations using affected versions of django CMS should prioritize updating to version 5.0.9 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.