Executive brief
Slippers is a user interface framework for the Django web platform that helps developers build reusable components. A security flaw in the way it handles HTML attributes allows attackers to inject malicious scripts into web pages viewed by other users. This could lead to unauthorized actions being taken in a user's session, such as stealing login information or defacing the website.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Slippers Django package within the `{% attrs %}` template tag. The root cause is located in the `attr_string` function within `slippers/templatetags/slippers.py`, where context variables are interpolated into HTML attribute strings using f-strings without proper escaping. Because the `AttrsNode` is a custom Django template `Node` rather than a `simple_tag`, it does not benefit from Django's automatic output escaping. An attacker can provide crafted input (e.g., via URL parameters) that breaks out of the HTML attribute context to execute arbitrary JavaScript in the victim's browser. The issue is fixed in version 0.6.3 by utilizing `django.utils.html.format_html` for safe attribute generation.
Affected products
- mixxorz slippers < 0.6.3
Timeline
- 2026-03-30: patched: Version 0.6.3 released
- 2026-03-31: disclosed: Security advisory published