A stored XSS flaw exists in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. When data is persisted in a URLField without model validation, the admin’s display_for_field helper renders the value as a clickable link without checking the scheme. After clicking the link, a staff user can trigger arbitrary script execution in the admin browser context, compromising confidentiality and integrity. The weakness is identified as CWE‑83, unvalidated URL input used in HTML output.

The vulnerability impacts installations of the Django framework, specifically Django 5.2 prior to version 5.2.17 and Django 6.0 prior to 6.0.8. Any application that stores URLField values directly in the database, bypassing model form validation, is potentially affected.

The CVSS score of 5.1 indicates a medium severity risk. Exploitation requires that an unsafe scheme value already exist in the database; it can be triggered by a staff‑level admin clicking the rendered link. The EPSS is not available, and the issue is not listed in CISA’s KEV catalog. The attack would proceed by a user interacting with the admin interface, so it is an in‑application attack vector aimed at authenticated staff accounts.