https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:24:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-48060 <p><strong>Affected:</strong> litestar-org litestar</p> <p>Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.</p> <p><strong>Affected:</strong> litestar-org litestar</p> <p>Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-48060 https://vulnerability.circl.lu/vuln/pysec-2026-2604 <p><strong>Affected:</strong> PyPI: litestar</p> <p># Overview</p> <p>Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations.</p> <p>We used the latest Litestar version available via PyPI for this disclosure. At the time of writing, that is version 2.21.0 and we have not validated this against the current latest commit on the main branch.</p> <p># Special Configurations Required</p> <p>For a web application to be vulnerable to this issue, it must:</p> <p>- Use templates to render the content which is returned to the user (e.g. Jinja, Mako, MiniJinja) - Have CSRF protection enabled - Have CSRF inputs enabled (i.e. a hidden form field which contains the CSRF token)</p> <p>**Links to relevant documentation for the above configurations:**</p> <p>- https://docs.litestar.dev/2/usage/templating.html - https://docs.litestar.dev/latest/usage/middleware/builtin-middleware.html#csrf - https://docs.litestar.dev/latest/usage/templating.html#adding-csrf-inputs</p> <p># Reproduction Steps</p> <p>1. Visit an application which contains a form, uses templating, has CSRF protection enabled, and which inserts the CSRF token as a hidden `input` field on forms. A proof of concept application demonstrating this configuration is included later in this disclosure for ease of reproduction. 2. Observe that the server sets the `csrftoken` cooki…</p> <p><strong>Affected:</strong> PyPI: litestar</p> <p># Overview</p> <p>Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations.</p> <p>We used the latest Litestar version available via PyPI for this disclosure. At the time of writing, that is version 2.21.0 and we have not validated this against the current latest commit on the main branch.</p> <p># Special Configurations Required</p> <p>For a web application to be vulnerable to this issue, it must:</p> <p>- Use templates to render the content which is returned to the user (e.g. Jinja, Mako, MiniJinja) - Have CSRF protection enabled - Have CSRF inputs enabled (i.e. a hidden form field which contains the CSRF token)</p> <p>**Links to relevant documentation for the above configurations:**</p> <p>- https://docs.litestar.dev/2/usage/templating.html - https://docs.litestar.dev/latest/usage/middleware/builtin-middleware.html#csrf - https://docs.litestar.dev/latest/usage/templating.html#adding-csrf-inputs</p> <p># Reproduction Steps</p> <p>1. Visit an application which contains a form, uses templating, has CSRF protection enabled, and which inserts the CSRF token as a hidden `input` field on forms. A proof of concept application demonstrating this configuration is included later in this disclosure for ease of reproduction. 2. Observe that the server sets the `csrftoken` cooki…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2604