Nixpkgs security tracker

Login with GitHub

Suggestions search

Untriaged
Filter by:
With package: python314Packages.litestar-htmx

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-48060
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 6 days, 10 hours ago Activity log
  • Created suggestion 6 days, 10 hours ago
Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.

Affected products

litestar
  • ==< 2.20.0

Matching in nixpkgs

pkgs.litestar

Production-ready, Light, Flexible and Extensible ASGI API framework

Package maintainers