PYSEC-2026-2279

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/slippers/PYSEC-2026-2279.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2279
Aliases
Published
2026-03-31T16:16:32.603Z
Modified
2026-07-13T07:15:42.377432380Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3.

References

Affected packages

PyPI / slippers

Package

Name
slippers
View open source insights on deps.dev
Purl
pkg:pypi/slippers

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.6.3

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.3.0
0.3.1
0.3.2
0.4.0
0.5.0a0
0.5.0
0.6.0a0
0.6.0
0.6.1a0
0.6.1
0.6.2

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/slippers/PYSEC-2026-2279.yaml"