Who contributed to Django on August 5, 2026?

2 developers shipped this update, including Natalia and Jacob Walls.

What were the notable Django updates?

Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links, Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups, and Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES FOUR CRITICAL VULNERABILITIES IN ADMIN AND SPATIAL QUERIES

By RepoJournal · Filed 06:55 UTC on August 5, 2026 · About Django

2 people shipped this

Natalia @nessita 3 cited

Jacob Walls @jacobtylerwalls 2 cited

Django shipped fixes for four CVEs overnight, including a stored XSS in admin URL rendering that could compromise staff accounts and three denial-of-service vectors in geolocation and language handling.

The most dangerous fix addresses CVE-2026-15920, where the admin renders URLField values as clickable links without validating them first [1]. A stored malicious URL could execute script in a staff member's authenticated session when clicked on changelists or read-only forms. Three additional CVEs landed in the same batch: CVE-2026-15307 blocks raster strings and dicts in spatial lookups that could trigger disk writes or network fetches through the GDALRaster constructor [2], CVE-2026-15830 mitigates DoS via nested geometry collections by adding max_geom_collections argument to limit either depth or total count before reaching GEOS [3], and CVE-2026-15337 rejects language codes longer than 500 characters before cache lookup to prevent memory exhaustion [4]. All four have been added to Django's security archive [5]. This is the security batch you patch immediately: URL validation in admin is table-stakes, and the spatial/internationalization DoS vectors hit production deployments using GIS or multi-language features.

Action items

→ Patch Django immediately for CVE-2026-15920 (admin XSS) django/django [immediate]
→ Apply CVE-2026-15307, CVE-2026-15830, CVE-2026-15337 fixes if you use GeoDjango or i18n django/django [immediate]
→ Review admin URLField rendering in your codebase for similar patterns django/django [plan]

References

[1] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links. django/django
[2] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups. django/django
[3] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections. django/django
[4] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language(). django/django
[5] Added CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 to security archive. django/django

Quick answers

What shipped in Django on August 5, 2026?: Django shipped fixes for four CVEs overnight, including a stored XSS in admin URL rendering that could compromise staff accounts and three denial-of-service vectors in geolocation and language handling. In total, 8 commits and 2 pull requests landed.
Who contributed to Django on August 5, 2026?: 2 developers shipped this update, including Natalia and Jacob Walls.
What were the notable Django updates?: Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links, Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups, and Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.

DJANGO ADDS FREE-THREADED PYTHON 3.14T TO POSTGIS CI

Django is validating free-threaded Python 3.14t against GIS tests, signaling serious commitment to the no-GIL future.

python 14 shipped

@django Aug 3

DJANGO FIXES NULL TIME FIELD HANDLING IN GEOSPATIAL MAPPING

LayerMapping now correctly reads null time fields after a follow-up alignment with OFTDate and OFTDateTime value properties.

python 3 shipped

@django Aug 2

DJANGO-LOCALFLAVOR 5.1 SHIPS WITH VATIN VALIDATOR FIX

Django-localflavor bumped to 5.1 [ref:4], capping a release cycle that fixed a typo in the VATINValidator that could have caused validation edge cases.

python 4 shipped

@django Aug 1

PARALLEL TEST WORKERS NOW REUSE DATABASE CLONES, KILLING FLAKY TEST RUNS

Django fixed a critical race condition where respawned test workers would crash trying to connect to non-existent database clones, causing entire parallel test suites to abort.

python 17 shipped

Elsewhere on the wire

AI Agents Aug 5

HITL APPROVAL GATES STOP SILENTLY FAILING OPEN, AIOHTTP FIXES REDIRECT LEAKS ACROSS LANGCHAIN STACK

LangChain plugged a critical security hole in human-in-the-loop middleware where invalid configurations silently disabled approval gates, while simultaneously patching a cascade of aiohttp vulnerabilities that leak headers across origin boundaries.

ai-agents 121 shipped

Local LLMs Aug 5

OLLAMA FIXES RACE CONDITIONS AS LLAMA.CPP SHIPS BREAKING TTS CHANGES

Ollama patched critical data races across its progress tracking system while llama.cpp introduces incompatible Qwen3-TTS support, and vLLM lands kernel optimizations that cut latency on specialized hardware.

+11

llms 246 shipped

@CachyOS Aug 5

SHELLY LANDS IN PKGBUILDS, CLI INSTALLER FIXES BOOTLOADER BUGS

CachyOS shipped shelly support across the build system while the new CLI installer tackles critical bootloader installation failures that blocked users mid-setup.