CVE-2026-125112

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-125112

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125112.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-125112

Aliases

GHSA-xjw9-38cr-6372

Published

2026-11-09T22:08:05Z

Modified

2026-11-11T02:48:48Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

djust: A template binding inherits a context safety grant it never earned (XSS)

Details

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125112.json"
}

References

Affected packages

Git / github.com/djust-org/djust

Affected ranges

Type

GIT

Repo

https://github.com/djust-org/djust

Events

Introduced

Fixed

c615635e8bfdb2b333658dbc28ce4b793541cdb0

Introduced

de44fa0387807348082de560024c4dfa5aa8b3c6

Fixed

de163a0e9236478b4a538f65bc2c7f6ea2dc27c3

Fixed

06d213dbdd82f5b1c2affe2f869ae88a71809e4a

Fixed

5288e5dbc8d83d8aee8a22a0a7a3a478461c8965

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.0.10"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "1.1.0"
                },
                {
                    "fixed": "1.1.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "06d213dbdd82f5b1c2affe2f869ae88a71809e4a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "5288e5dbc8d83d8aee8a22a0a7a3a478461c8965"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.0.10",
            "range": [
                {
                    "fixed": "c615635e8bfdb2b333658dbc28ce4b793541cdb0"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v1.1.2",
            "range": [
                {
                    "fixed": "de163a0e9236478b4a538f65bc2c7f6ea2dc27c3"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.2.0

v0.2.0a1

v0.2.0a2

v0.2.1

v0.2.1a1

v0.2.2

v0.2.2rc1

v0.2.2rc2

v0.2.2rc3

v0.2.2rc5

v0.3.0

v0.3.0rc1

v0.3.0rc2

v0.3.0rc3

v0.3.0rc4

v0.3.0rc5

v0.3.1

v0.3.2rc1

v0.3.3rc1

v0.3.3rc2

v0.3.3rc3

v0.3.4

v0.3.5

v0.3.5rc1

v0.3.5rc2

v0.3.6

v0.3.6rc1

v0.3.6rc2

v0.3.6rc3

v0.3.6rc4

v0.3.7

v0.3.7rc1

v0.3.7rc2

v0.3.8

v0.3.8rc1

v0.4.0

v0.4.0rc3

v0.4.1

v0.4.1rc1

v0.4.1rc2

v0.4.2

v0.4.2rc1

v0.4.2rc2

v0.4.2rc3

v0.4.2rc4

v0.4.3

v0.4.3rc1

v0.4.4

v0.4.4rc1

v0.4.5rc1

v0.4.5rc2

v0.5.0rc1

v0.5.0rc2

v0.5.1rc1

v0.5.1rc2

v0.5.1rc4

v0.5.2rc1

v0.5.3rc1

v0.5.4rc1

v0.5.5rc1

v0.5.6rc1

v0.5.7rc1

v0.6.0rc1

v0.6.1rc1

v0.7.0rc1

v0.7.1rc1

v0.7.2rc1

v0.7.3rc1

v0.7.4rc1

v0.8.0rc1

v0.8.2rc1

v0.8.3rc1

v0.8.4rc1

v0.8.5rc1

v0.8.6rc1

v0.8.7rc1

v0.8.8rc1

v0.8.8rc2

v0.9.0

v0.9.0rc1

v0.9.0rc2

v0.9.0rc3

v0.9.0rc4

v0.9.0rc5

v0.9.1

v0.9.2

v0.9.2rc1

v0.9.2rc2

v0.9.3rc1

v0.9.3rc2

v0.9.4

v0.9.4rc1

v0.9.4rc2

v0.9.4rc3

v0.9.4rc5

v0.9.4rc6

v0.9.4rc7

v0.9.4rc8

v0.9.4rc9

v0.9.5

v0.9.5rc1

v0.9.5rc2

v0.9.5rc3

v0.9.5rc4

v0.9.6

v0.9.6rc1

v0.9.6rc2

v0.9.6rc3

v0.9.7

v0.9.7rc1

v0.9.7rc2

v0.9.7rc3

v1.*

v1.0.0

v1.0.0rc1

v1.0.0rc10

v1.0.0rc11

v1.0.0rc12

v1.0.0rc13

v1.0.0rc14

v1.0.0rc15

v1.0.0rc16

v1.0.0rc17

v1.0.0rc18

v1.0.0rc2

v1.0.0rc3

v1.0.0rc4

v1.0.0rc6

v1.0.0rc7

v1.0.0rc8

v1.0.0rc9

v1.0.1

v1.0.1rc1

v1.0.2

v1.0.2rc1

v1.0.2rc2

v1.0.2rc3

v1.0.3

v1.0.3rc1

v1.0.3rc2

v1.0.4

v1.0.4rc1

v1.0.5

v1.0.5rc1

v1.0.5rc2

v1.0.5rc3

v1.0.5rc4

v1.0.5rc5

v1.0.6

v1.0.6rc1

v1.0.6rc2

v1.0.6rc3

v1.0.7

v1.0.7rc1

v1.0.8

v1.0.8rc1

v1.0.9

v1.1.0

v1.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125112.json"