PyPI/wagtail CVE-2026-28222: medium 6.1, EPSS 0.63%
Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock
Action: Upgrade wagtail to 6.3.8 or later.
pip install wagtail==6.3.8pip install wagtail==7.0.6pip install wagtail==7.2.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.3.8 | - |
| 6.4 | 7.0.6 | - |
| 7.1 | 7.2.3 | - |
Fixed versions
| 6.3.8 | 7.0.6 | 7.2.3 |
Sources
- osv: PYSEC-2026-2307
- https://github.com/wagtail/wagtail/releases/tag/v6.3.8
- https://github.com/wagtail/wagtail/releases/tag/v7.0.6
- https://github.com/wagtail/wagtail/releases/tag/v7.2.3
- https://github.com/wagtail/wagtail/releases/tag/v7.3.1
- https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm
- https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d
- https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e
- https://github.com/wagtail/wagtail/commit/575c0d7c18c7716ed73f7a3c2720ad75956f0a85
- https://github.com/wagtail/wagtail/commit/605a5569686565e035313222e1bc2f9802fbc55b
CVE-2026-28222 · published · modified · JSON