DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-9395-2G46-RJ3F: GHSA-9395-2G46-RJ3F: Multiple Cross-Site Scripting (XSS) Vulnerabilities in djust Template and Live Engine

#security #cve #cybersecurity #ghsa

GHSA-9395-2G46-RJ3F: Multiple Cross-Site Scripting (XSS) Vulnerabilities in djust Template and Live Engine

Vulnerability ID: GHSA-9395-2G46-RJ3F
CVSS Score: 8.2
Published: 2026-09-17

A comprehensive technical analysis of six Cross-Site Scripting (XSS) vulnerability classes in the djust framework versions 1.0.0 through 1.1.0, involving escaping failures across the Python-Rust template boundary and stateful WebSocket cache lifecycles.

TL;DR

djust versions 1.0.0 through 1.1.0 contain multiple high-severity XSS vectors due to improper escaping in filters, slot rendering, and stateful WebSockets. Upgrading to 1.1.1 is required to secure affected applications.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Vulnerability Class: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting)
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Privileges Required: None (PR:N)
  • User Interaction: Required (UI:R)
  • Scope: Changed (S:C)
  • Exploit Status: Functional Proof-of-Concept (PoC) available

Affected Systems

  • djust application deployments
  • djust template engine (djust_templates)
  • djust live-view backend (djust_live)
  • djust: >= 1.0.0, <= 1.1.0 (Fixed in: 1.1.1)

Mitigation Strategies

  • Upgrade djust to version 1.1.1 or higher immediately.
  • Implement a strict Content Security Policy (CSP) with restrictive script-src directives to prevent execution of injected scripts.
  • Perform code audits to identify and replace vulnerable template filters such as unordered_list and safeseq with manual loop rendering.
  • Sanitize Python variables before passing them into component slots or WebSocket state synchronizations.

Remediation Steps:

  1. Open your application's dependency specification file (e.g., requirements.txt, pyproject.toml).
  2. Modify the djust entry to require version 1.1.1 or higher (djust >= 1.1.1).
  3. Rebuild and redeploy your application to ensure all production environments run the updated package.
  4. Deploy a Content Security Policy (CSP) header specifying 'script-src' with secure nonces or hashes.
  5. Configure your Web Application Firewall (WAF) or API gateway to inspect active WebSocket streams for potential HTML script injections.

References

Read the full report for GHSA-9395-2G46-RJ3F on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)