{"uuid": "aca7acce-9d2c-4db8-8240-b0d7b0f4f85d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9395-2G46-RJ3F", "type": "seen", "source": "https://gist.github.com/alon710/cb18b141add55b295dbcd30cffe58ba1", "content": "# GHSA-9395-2G46-RJ3F: GHSA-9395-2G46-RJ3F: Multiple Cross-Site Scripting (XSS) Vulnerabilities in djust Template and Live Engine\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/GHSA-9395-2G46-RJ3F\n\n## Summary\nA comprehensive technical analysis of six Cross-Site Scripting (XSS) vulnerability classes in the djust framework versions 1.0.0 through 1.1.0, involving escaping failures across the Python-Rust template boundary and stateful WebSocket cache lifecycles.\n\n## TL;DR\ndjust versions 1.0.0 through 1.1.0 contain multiple high-severity XSS vectors due to improper escaping in filters, slot rendering, and stateful WebSockets. Upgrading to 1.1.1 is required to secure affected applications.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Vulnerability Class**: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: Required (UI:R)\n- **Scope**: Changed (S:C)\n- **Exploit Status**: Functional Proof-of-Concept (PoC) available\n\n## Affected Systems\n\n- djust application deployments\n- djust template engine (djust_templates)\n- djust live-view backend (djust_live)\n- **djust**: >= 1.0.0, <= 1.1.0 (Fixed in: `1.1.1`)\n\n## Mitigation\n\n- Upgrade djust to version 1.1.1 or higher immediately.\n- Implement a strict Content Security Policy (CSP) with restrictive script-src directives to prevent execution of injected scripts.\n- Perform code audits to identify and replace vulnerable template filters such as unordered_list and safeseq with manual loop rendering.\n- Sanitize Python variables before passing them into component slots or WebSocket state synchronizations.\n\n**Remediation Steps:**\n1. Open your application's dependency specification file (e.g., requirements.txt, pyproject.toml).\n2. Modify the djust entry to require version 1.1.1 or higher (djust >= 1.1.1).\n3. Rebuild and redeploy your application to ensure all production environments run the updated package.\n4. Deploy a Content Security Policy (CSP) header specifying 'script-src' with secure nonces or hashes.\n5. Configure your Web Application Firewall (WAF) or API gateway to inspect active WebSocket streams for potential HTML script injections.\n\n## References\n\n- [djust Main Repository](https://github.com/djust-org/djust)\n- [GitHub Security Advisory GHSA-9395-2G46-RJ3F](https://github.com/advisories/GHSA-9395-2G46-RJ3F)\n- [djust v1.1.1 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.1.1)\n- [djust comparative diff v1.1.0 to v1.1.1](https://github.com/djust-org/djust/compare/v1.1.0...v1.1.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-9395-2G46-RJ3F) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T13:32:11.125840Z"}