Multiple template-layer defects in djust versions prior to 1.1.1 cause attacker-controlled input to be rendered as live markup without proper escaping, resulting in stored or reflected cross-site scripting (XSS). These defects affect various filters and template constructs, including linenumbers, escape, unordered_list, safeseq, render_slot, and linebreaks, allowing untrusted input to execute script code. The vulnerabilities require no special configuration and some are exploitable with typical application usage patterns. The issues are fixed in djust version 1.1.1 and later.