CVE-2026-129156

The DjangoBlog application (commits d186b1c through 6134ed6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the comment reactions feature. The root cause is an unescaped nickname used by authenticated OAuth users. An attacker can set their OAuth display name to a malicious payl...