GHSA-XJW9-38CR-6372: Cross-Site Scripting via Stale Safe-Key Inheritance in djust Template Shadowing
Vulnerability ID: GHSA-XJW9-38CR-6372
CVSS Score: 8.2
Published: 2026-09-17
An escaping defect in the djust templating engine allows Cross-Site Scripting (XSS) when a template binding construct shadows a variable that was previously marked safe. The Rust-based context safety tracking incorrectly preserves name-based safety grants even after the variable name has been bound to a new, untrusted value.
TL;DR
A name-based context safety grant in djust is inherited by shadowed variables, causing raw rendering of untrusted values and allowing unauthenticated remote execution of arbitrary JavaScript.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network (AV:N)
- CVSS v3.1: 8.2 (High)
- Exploit Status: PoC
- KEV Status: Not Listed
- Impact: Cross-Site Scripting (XSS)
Affected Systems
- djust-org/djust (Python/Rust template library)
-
djust: >= 1.0.0, <= 1.1.1 (Fixed in:
1.1.2)
Exploit Details
- GitHub: Integration and regression tests demonstrating the exploit via template bindings.
Mitigation Strategies
- Upgrade the djust package to version 1.1.2 or higher.
- Audit templates to identify and remove variable shadowing where safe-marked variables are reused with dynamic inputs.
- Deploy WAF rules to detect and drop common XSS payloads in parameters.
Remediation Steps:
- Verify current djust installation: pip show djust
- Update djust package: pip install --upgrade djust>=1.1.2
- Restart application servers to apply updated Rust bindings.
- Run template validation tests to verify that HTML-escaping is active on shadowed variables.
References
- GHSA-XJW9-38CR-6372 Advisory Database entry
- djust Release v1.1.2
- GitHub Patch Comparison
- Raw Git Diff (Plaintext Patch)
Read the full report for GHSA-XJW9-38CR-6372 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)