CVE-2021-29434 Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
A malicious admin user can inject JavaScript into rich text fields due to missing server-side URL validation, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-29434?
CVE-2021-29434 is a medium-severity cross-site scripting vulnerability in wagtail, published on 19 Apr 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with `javascript:` URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. See referenced GitHub advisory for additional details, including a workaround. Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).
Weakness: CWE-79
Which versions are affected by CVE-2021-29434?
5 open source packages ship an affected version, including wagtail. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wagtail PyPI | All versions | 2.11.7 |
wagtail PyPI | All versions | 2.11.7 |
wagtail PyPI | From 2.11 | 2.11.7, 2.11.6, 2.12.4 |
wagtail PyPI | From 2.12 | 2.12.4 |
wagtail PyPI | From 2.12 | 2.12.4 |
Products include Torchbox Wagtail.
How do I fix CVE-2021-29434?
Upgrade wagtail to a fixed version for your release line: 2.11.7, 2.11.6 or 2.12.4.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-29434 being exploited?
There is no known exploitation of CVE-2021-29434 in the wild and no public exploit code.
Other vulnerabilities in wagtail
- CVE-2026-54263 Wagtail: Reflected XSS in dynamic image URL generator view
- CVE-2026-54261 Wagtail: Improper permission handling in image preview
- CVE-2026-44197 Wagtail: Improper permission handling when comparing revisions
- CVE-2026-44199 Wagtail: Improper permission handling when deleting form submissions
- CVE-2026-44200 Wagtail: Improper permission handling when copying pages
Sources
Also known as GHSA-wq5h-f9p5-q7fx, PYSEC-2021-114.