UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15118

HTML injection through form field help text

Severity
Medium 5.4
Published
20 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.7.4, 2.9.3
Also known as
GHSA-2473-9hgq-j7xw
Sources
NVD, Project advisories (GitHub)

Description

In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used within a form field's help text will be rendered unescaped in the page. Allowing HTML within help text is an intentional design decision…

Affected software

SoftwareAffected versions
WagtailServers and applications · cpe:a:torchbox:wagtail
  • From 2.7 before 2.7.4
  • From 2.9 before 2.9.3
WagtailServers and applications · github:wagtail/wagtail
  • From 2.9 before 2.7.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15118
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15118
  • GitHub Advisory Database https://github.com/advisories/GHSA-2473-9hgq-j7xw
  • github.com https://github.com/wagtail/wagtail/security/advisories/GHSA-2473-9hgq-j7xw