CVE-2026-125112 djust: A template binding inherits a context safety grant it never earned (XSS)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125112?
CVE-2026-125112 is a low-severity vulnerability in djust-org djust, published on 9 Nov 2026.
Official description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.
Which versions are affected by CVE-2026-125112?
2 open source packages ship an affected version, including djust.
| Package | Affected | Fixed in |
|---|---|---|
djust PyPI | All versions | 1.0.10 |
djust PyPI | From 1.1.0 | 1.1.2 |
How do I fix CVE-2026-125112?
Upgrade djust to a fixed version for your release line: 1.0.10 or 1.1.2.
Is CVE-2026-125112 being exploited?
There is no known exploitation of CVE-2026-125112 in the wild and no public exploit code.
Sources
Also known as GHSA-xjw9-38cr-6372.