CVE-2026-71239

The record

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.

Affected packages

Related vulnerabilities

• CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
• CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
• CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
• CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
• CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336
• CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK… CWE-1336