{"id":"CVE-2026-125112","published":"2026-11-09T22:18:42.587","lastModified":"2026-11-09T22:18:42.717","description":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79","CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a","tags":[]},{"url":"https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965","tags":[]},{"url":"https://github.com/djust-org/djust/pull/2444","tags":[]},{"url":"https://github.com/djust-org/djust/releases/tag/v1.0.10","tags":[]},{"url":"https://github.com/djust-org/djust/releases/tag/v1.1.2","tags":[]},{"url":"https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372","tags":[]}],"exploitRefs":[{"url":"https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a","tags":[]},{"url":"https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965","tags":[]},{"url":"https://github.com/djust-org/djust/pull/2444","tags":[]},{"url":"https://github.com/djust-org/djust/releases/tag/v1.0.10","tags":[]},{"url":"https://github.com/djust-org/djust/releases/tag/v1.1.2","tags":[]},{"url":"https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372","tags":[]}],"hasPoc":true,"ai":null}