CVE-2026-34231 Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag
Attackers can inject arbitrary JavaScript via unescaped attributes in the Slippers Django framework, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34231?
CVE-2026-34231 is a medium-severity cross-site scripting vulnerability in mixxorz slippers, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3.
Weakness: CWE-79
Which versions are affected by CVE-2026-34231?
3 open source packages ship an affected version, including slippers. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
slippers PyPI | All versions | 0.6.3 |
slippers PyPI | All versions | 0.6.3 |
slippers PyPI | All versions | 0.6.3 |
Products include Django Slippers.
How do I fix CVE-2026-34231?
Upgrade slippers to 0.6.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-34231 being exploited?
There is no known exploitation of CVE-2026-34231 in the wild and no public exploit code.
Sources
Also known as GHSA-w7rv-gfp4-j9j3, PYSEC-2026-2279.