CVE-2026-125112 | BDVDB-2026-402491 Detail
djust-orgdjust
Description#
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.
Impact#
Per CVSS v4.0: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
References#
- https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372
- https://github.com/djust-org/djust/pull/2444
- https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a
- https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965
- https://github.com/djust-org/djust/releases/tag/v1.0.10
- https://github.com/djust-org/djust/releases/tag/v1.1.2
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.