PT-2026-44073 · Relate+1 · Relate+1

Ruslan Armahov · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-42197

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions RELATE versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620

Description A stored cross-site scripting issue allows enrolled students to execute arbitrary JavaScript in an administrator's browser session, which could lead to a full admin account takeover. The get user() function in ParticipationAdmin uses mark safe with Python's % string formatting to render user-controlled input, bypassing Django's automatic HTML escaping. The values are derived from the first name and last name fields of the User model, which are editable by authenticated users via the '/profile/' endpoint without sanitization. The script executes when an administrator views the Participation list in the Django admin panel.

Recommendations Update to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42197

Affected Products

Django

Relate

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-42197 · Security Note
• https://github.com/inducer/relate/security/advisories/GHSA-37xm-vhx8-g6w3 · Note
• https://github.com/inducer/relate/commit/555f0efb1c5bd7531c07cd73724d7e566a81f620 · Note
• https://github.com/inducer/relate/blob/550b8c54eb4d5f3e5f6698dcba361bf34d715599/course/admin.py#L347-L368 · Note
• https://twitter.com/CVEnew/status/2059718103307899209 · Twitter Post