CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NCVE-2021-29434
Medium (4.8) in torchbox wagtail. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in wagtail 2.11.6, 2.11.7, 2.12.4.
Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with `javascript:` URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. See referenced GitHub advisory for additional details, including a workaround. Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- torchbox:wagtail
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wq5h-f9p5-q7fx | PyPI | wagtail | <2.11.7 | 2.11.7 |
| GHSA-wq5h-f9p5-q7fx | PyPI | wagtail | >=2.12 <2.12.4 | 2.12.4 |
| PYSEC-2021-114 | PyPI | wagtail | >=2.11 <2.11.7 <2.11.6 >=2.12 <2.12.4 | 2.11.7, 2.11.6, 2.12.4 |