CVE-2026-48060: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in litestar-org litestar
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.
AI Analysis
Technical Summary
CVE-2026-48060 is a CWE-79 cross-site scripting vulnerability in the Litestar ASGI framework. Prior to version 2.20.0, when Litestar instances use a template engine alongside CSRF protection, the CSRF cookie content is not automatically escaped as recommended, leading to HTML injection. This injection can be escalated to cross-site scripting attacks. The issue has been addressed and fixed in Litestar version 2.20.0.
Potential Impact
Successful exploitation allows an attacker to inject malicious HTML or scripts via the CSRF cookie content, potentially leading to cross-site scripting attacks that compromise confidentiality and integrity of user data. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity but no impact on availability.
Mitigation Recommendations
Upgrade Litestar to version 2.20.0 or later, where this vulnerability has been patched. No other mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the description stating the issue is fixed in version 2.20.0.
CVE-2026-48060: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in litestar-org litestar
Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.
CVSS v3.1
Score 8.1high
Affected software
litestar-org
litestar
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48060 is a CWE-79 cross-site scripting vulnerability in the Litestar ASGI framework. Prior to version 2.20.0, when Litestar instances use a template engine alongside CSRF protection, the CSRF cookie content is not automatically escaped as recommended, leading to HTML injection. This injection can be escalated to cross-site scripting attacks. The issue has been addressed and fixed in Litestar version 2.20.0.
Potential Impact
Successful exploitation allows an attacker to inject malicious HTML or scripts via the CSRF cookie content, potentially leading to cross-site scripting attacks that compromise confidentiality and integrity of user data. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity but no impact on availability.
Mitigation Recommendations
Upgrade Litestar to version 2.20.0 or later, where this vulnerability has been patched. No other mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the description stating the issue is fixed in version 2.20.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:25:25.707Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6905029c2644c7f81a8622
Added to database: 07/28/2026, 19:37:38 UTC
Last enriched: 07/29/2026, 14:39:18 UTC
Last updated: 09/11/2026, 22:06:33 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.