Cross-Site Scripting Vulnerability in Djust Framework by Djust
CVE-2026-125112
What is CVE-2026-125112?
The Djust framework, known for its Phoenix LiveView-style reactive server-side rendering capabilities with Rust-powered performance, is susceptible to a vulnerability that allows both stored and reflected Cross-Site Scripting (XSS). This issue stems from the way Djust manages context output-safety grants by variable name. It fails to revoke these grants appropriately when a template binds a new value to that variable name. Consequently, an attacker can manipulate template operations such as {% with %}, {% for %}, or {% include ... with %}, leading to the potential exposure of user data when the affected template is rendered. This vulnerability has been addressed in versions 1.0.10 and 1.1.2, effectively mitigating the risk associated with the affected template rendering functionality.
Affected Version(s)
djust < 1.0.10 < 1.0.10
djust >= 1.1.0, < 1.1.2 < 1.1.0, 1.1.2