Cross-site scripting via URLField values in Django admin (CVE-2026-15920)

The Django admin renders URLField values as clickable links on changelist views and read-only fields without validating the URL as safe. A stored value using a potentially dangerous scheme was rendered as a link, enabling cross-site scripting. URLField values shown via display_for_field are now validated using URLValidator before a link is rendered, and displayed as plain text if validation fails. Affected versions: - Django main - Django 6.1 (currently at release candidate status) - Django 6.0 - Django 5.2 We recommend updating to: Django 6.0.8, Django 5.2.17. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/406 Details: https://vuln.today/cve/CVE-2026-15920