CVE-2026-125112— djust: A template binding inherits a context safety grant it never earned (XSS)

Quick assessment

Affected

djust-org djust

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Djust 为 Django 提供类似 Phoenix LiveView 的响应式服务端渲染功能，并借助 Rust 实现高性能。在 1.0.10 和 1.1.2 版本之前，Djust 根据变量名称来管理上下文中输出的安全性授权，当模板绑定替换了与该名称关联的值时，无法撤销原有的授权。因此，使用、、、元组解包或标签的模板，可以重新绑定此前持有内容的变量名，从而在未进行转义的情况下输出由攻击者控制的新值，包括通过该重新绑定的名称进行的后代查找。当受害者渲染受影响的模板时，可能导致存储型或反射型跨站脚本攻击（X

CVSS 2.3 · Low Updated Nov 10, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

djust: A template binding inherits a context safety grant it never earned (XSS)

Source: CVE Program / CVE List V5

Vulnerability Description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
djust-org	djust	< 1.0.10	-

II. Public POCs for CVE-2026-125112

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125112

请登录查看更多情报信息。

Vendor Pages for CVE-2026-125112 (1)

🔗 Release v1.0.10 · djust-org/djust · GitHub Read full article x_refsource_MISC

Other References for CVE-2026-125112 (5)

https://github.com/djust-org/djust/pull/2444 x_refsource_MISC
https://github.com/djust-org/djust/releases/tag/v1.1.2 x_refsource_MISC
https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372 x_refsource_CONFIRM
https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a x_refsource_MISC
https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-125112

IV. Related Vulnerabilities

Same product: djust

Same vendor: djust-org

Same weakness: CWE-79