Read the docs
TI-2021-10147 Aliases CVE-2021-29434GHSA-wq5h-f9p5-q7fx

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with `javascript:` URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. See referenced GitHub advisory for additional details, including a workaround. Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).

Why it matters now

EPSS 0.00626 50th percentileScored 2026-11-07
Fix Fixed wagtail (PyPI): 2.11.7, 2.12.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
wagtailwagtailup to 2.11.6; 2.12 – 2.12.3—No fix listedCNA
—wagtail (PyPI)before 2.11.72.11.7Patch availableGHSA-wq5h-f9p5-q7fx
—wagtail (PyPI)2.12 to before 2.12.42.12.4Patch availableGHSA-wq5h-f9p5-q7fx
  • wagtail Vendorwagtail Affected up to 2.11.6; 2.12 – 2.12.3 Fixed in — No fix listed CNA
  • wagtail (PyPI) Vendor— Affected before 2.11.7 Fixed in 2.11.7 Patch available GHSA-wq5h-f9p5-q7fx
  • wagtail (PyPI) Vendor— Affected 2.12 to before 2.12.4 Fixed in 2.12.4 Patch available GHSA-wq5h-f9p5-q7fx

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:torchbox:wagtail:*:*:*:*:-:*:*:*before 2.11.6Vulnerablewagtail
cpe:2.3:a:torchbox:wagtail:*:*:*:*:lts:*:*:*2.11.0 to before 2.11.7Vulnerablewagtail
cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*2.12.0 to before 2.12.4Vulnerablewagtail
  • cpe:2.3:a:torchbox:wagtail:*:*:*:*:-:*:*:* Versions before 2.11.6 Vulnerable ·wagtail
  • cpe:2.3:a:torchbox:wagtail:*:*:*:*:lts:*:*:* Versions 2.11.0 to before 2.11.7 Vulnerable ·wagtail
  • cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:* Versions 2.12.0 to before 2.12.4 Vulnerable ·wagtail

Remediation

  • Fix · GHSA-wq5h-f9p5-q7fx wagtail (PyPI) Fixed in 2.11.7 Advisory →
  • Fix · GHSA-wq5h-f9p5-q7fx wagtail (PyPI) Fixed in 2.12.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29434
  2. 2026-10-03 Alias added: GHSA-wq5h-f9p5-q7fx
  3. 2026-10-31 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 6

  • TI-2026-39163 Wagtail: Reflected XSS in dynamic image URL generator view CVSS 3.1HIGH 7.3
  • TI-2020-08875 Possible XSS attack in Wagtail CVSS 3.1MEDIUM 6.8
  • TI-2023-13342 Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CVSS 3.1MEDIUM 6.4
  • TI-2026-32180 Wagtail: Improper restriction handling on Documents and Images API CVSS 3.1MEDIUM 5.3
  • TI-2026-22558 Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface CVSS 3.1MEDIUM 6.1
  • TI-2026-22557 Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes CVSS 3.1MEDIUM 6.1
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences