RepoJournal
Django @django
126 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-05
stories 10
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

DJANGO PATCHES FOUR CRITICAL VULNERABILITIES IN ADMIN AND SPATIAL QUERIES

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

Natalia Jacob Walls
2 people shipped this
Natalia @nessita 3 cited Jacob Walls @jacobtylerwalls 2 cited

Django shipped fixes for four CVEs overnight, including a stored XSS in admin URL rendering that could compromise staff accounts and three denial-of-service vectors in geolocation and language handling.

The most dangerous fix addresses CVE-2026-15920, where the admin renders URLField values as clickable links without validating them first [1]. A stored malicious URL could execute script in a staff member's authenticated session when clicked on changelists or read-only forms. Three additional CVEs landed in the same batch: CVE-2026-15307 blocks raster strings and dicts in spatial lookups that could trigger disk writes or network fetches through the GDALRaster constructor [2], CVE-2026-15830 mitigates DoS via nested geometry collections by adding max_geom_collections argument to limit either depth or total count before reaching GEOS [3], and CVE-2026-15337 rejects language codes longer than 500 characters before cache lookup to prevent memory exhaustion [4]. All four have been added to Django's security archive [5]. This is the security batch you patch immediately: URL validation in admin is table-stakes, and the spatial/internationalization DoS vectors hit production deployments using GIS or multi-language features.

Action items

References

  1. [1] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links. ↗ django/django
  2. [2] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups. ↗ django/django
  3. [3] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections. ↗ django/django
  4. [4] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language(). ↗ django/django
  5. [5] Added CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 to security archive. ↗ django/django

$ ls django/reviews/ # the step-back reads

the week in review Django drops PostgreSQL 15 and PostGIS 3.2 the month in review Django 6.1, four CVEs, and a parallel-test fix that kills flaky runs
Topics: Python Full archive → Weekly reviews →

Quick answers

What shipped in Django on August 5, 2026?
Django shipped fixes for four CVEs overnight, including a stored XSS in admin URL rendering that could compromise staff accounts and three denial-of-service vectors in geolocation and language handling. In total, 8 commits and 2 pull requests landed.
Who contributed to Django on August 5, 2026?
2 developers shipped this update, including Natalia and Jacob Walls.
What were the notable Django updates?
Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links, Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups, and Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.
♥

$ log @django --recent

Django drops PostgreSQL 15 and PostGIS 3.2, patches an admin date_hierarchy 500 7 shipped GenericIPAddressField accepts ipaddress objects, djangoproject.com tests go multi-browser 27 shipped GeneratedField null check reverted, sponsorship pages rebuilt 17 shipped Django ASV adds ubuntu-latest results, DSF publishes August and September minutes 2 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.