Djust versions before 1.1.1 contain six related template auto-escaping defects that allow attacker-controlled input to bypass escaping and be emitted as live markup, enabling XSS. The defects include: (1) linenumbers filter deferring escaping but suppressed by downstream safe filter; (2) escape filter being a no-op and allowing unsafe chains; (3) unordered_list and safeseq filters granting unsafe output when given strings; (4) safety grants persisting across WebSocket view lifetimes causing unsafe reuse of context variables; (5) custom tag handlers, including djust's own render_slot, emitting raw output without escaping; and (6) linebreaks and linebreaksbr filters requiring |safe to render correctly, which emits unescaped content. These defects are grouped due to shared mitigation—upgrading to 1.1.1—and no single defect is meaningfully actionable alone. The vulnerabilities enable stored or reflected XSS in any djust application rendering untrusted input through affected filters or reusing safe-marked variables.

The vulnerabilities allow stored or reflected cross-site scripting (XSS) in djust applications that render untrusted input via the affected filters or reuse context variables marked safe. Exploitation requires no special configuration or unusual template constructs for several defects, making the risk significant. XSS can lead to script execution in users' browsers, potentially compromising user sessions, stealing credentials, or performing actions on behalf of users.

A fix is available in djust version 1.1.1 and later (including 1.2.0). Users should upgrade to version 1.1.1 or newer to remediate these vulnerabilities. No other mitigation is meaningfully actionable given the nature of the defects and their shared fix. Check the vendor advisory for the latest remediation guidance.