CVE-2026-15920: An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field(

Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 have a bug where the admin interface displays URLField (a field for storing web addresses) values as clickable links without checking if the URLs are safe, allowing cross-site scripting (injecting malicious code that runs in a user's browser). The vulnerability only affects applications that store invalid URL data directly in the database without running validation checks, such as through bulk imports or direct database writes.