CVE-2026-125112

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2.

• https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a
• https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965
• https://github.com/djust-org/djust/pull/2444
• https://github.com/djust-org/djust/releases/tag/v1.0.10
• https://github.com/djust-org/djust/releases/tag/v1.1.2
• https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372

• https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a
• https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965
• https://github.com/djust-org/djust/pull/2444
• https://github.com/djust-org/djust/releases/tag/v1.0.10
• https://github.com/djust-org/djust/releases/tag/v1.1.2
• https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372

• UNSCOREDCVE-2026-102345PoC
• UNSCOREDCVE-2026-102530PoC
• MEDIUMCVE-2026-104250PoC
• UNSCOREDCVE-2026-104907PoC
• CRITICALCVE-2026-106102PoC
• UNSCOREDCVE-2026-106107PoC
• MEDIUMCVE-2026-107393PoC
• CRITICALCVE-2026-107845PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.