PyPI: wagtail
CVE-2026-54263
Safety vulnerability ID: SFTY-20260820-91329
Affected versions of the Wagtail package are vulnerable to Reflected Cross-site Scripting (XSS) due to improper handling of user input in the dynamic image URL generator view. The `generate_url` function within the Wagtail admin interface fails to properly sanitize URL parameters, allowing malicious scripts to be reflected back to users. An attacker with a limited-permission editor account can exploit this vulnerability by crafting a URL that, when accessed by a user with higher privileges, executes arbitrary actions with that user's credentials.
Overview
Wagtail: Reflected XSS in dynamic image URL generator view
Advisory
wagtail – Cross-site Scripting (XSS)
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260820-91329/CVE-2026-54263
- https://github.com/wagtail/wagtail/security/advisories/GHSA-23m2-mghx-vqmf
- https://nvd.nist.gov/vuln/detail/CVE-2026-54263
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-616.yaml
- https://github.com/advisories/GHSA-23m2-mghx-vqmf
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more