Django Security Update Fixes Server-Side File Write, XSS, and DoS Flaws

Django 6.0.8 and 5.2.17 have been released, addressing four vulnerabilities: high-severity server-side file write issues to moderate XSS and low/moderate DoS problems This article explores django limits wkt. . The fix blocks dict values and invalid GEOSGeometry strings from spatial lookups, a backward-incompatible change that doesn't impact direct model field assignments.

CVE-2026-15337 (low severity) affected django.utils.translation.check_for_language(), which cached arbitrarily long language codes as dictionary keys, potentially leading to memory exhaustion when accessed through the (non-default) set_language() view. Django now limits WKT inputs to 198 nested collections and WKB inputs to a maximum of 198 total collections (considering both breadth and depth), offering new options for customization through max_geom_collections arguments on GEOSGeometry, form fields, and model fields.

CVE-2026-15920 (moderate severity) discovered that Django admin rendered URLField values as clickable links on changelists and read-only fields without proper validation of the scheme, allowing stored values with dangerous schemes to be displayed as live links, enabling a stored XSS vector. Official tarballs and checksums are available for Django 6.0.8 and Django 5.2.17. Utilize in-browser data inspection from ANY.RUN to detect, investigate, and respond faster, ensuring a swift response time and reduced Mean Time To Respond (MTTR).