djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
Affects djustSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 1.1.1
Data as of 18 Sep 2026, 01:27 UTC
What to do
Upgrade djust to 1.1.1.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIdjust | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in djust version 1.1.1 and later (including 1.2.0). Users should upgrade to version 1.1.1 or newer to remediate these vulnerabilities. No other mitigation is meaningfully actionable given the nature of the defects and their shared fix. Check the vendor advisory for the latest remediation guidance.
Description
Multiple template-layer defects in djust versions prior to 1.1.1 cause attacker-controlled input to be rendered as live markup without proper escaping, resulting in stored or reflected cross-site scripting (XSS). These defects affect various filters and template constructs, including linenumbers, escape, unordered_list, safeseq, render_slot, and linebreaks, allowing untrusted input to execute script code. The vulnerabilities require no special configuration and some are exploitable with typical application usage patterns. The issues are fixed in djust version 1.1.1 and later.