djust versions prior to 1.1.2 contain a vulnerability where a template binding inherits a context safety grant it never earned, leading to stored or reflected cross-site scripting (XSS). This occurs when a view marks a value safe (e.g., using mark_safe) and a template later rebinds that name to attacker-controlled input, causing the safety mark to be incorrectly retained. The issue affects multiple template binding constructs such as {% with %}, {% for %}, {% include … with %}, and assign tags. The vulnerability is fixed in version 1.1.2 and later.