Executive brief
Litestar is a web framework used to build high-performance Python applications. A security flaw in how it handles Cross-Site Request Forgery (CSRF) protection allows attackers to inject malicious code into web pages viewed by users. If exploited, this could lead to unauthorized access to user accounts, theft of sensitive session data, or the defacement of the website.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Litestar when using a template engine (such as Jinja2, Mako, or MiniJinja) alongside CSRF protection. The root cause is that the `csrf_input` variable, which contains the CSRF token from a cookie, is marked as 'safe' or otherwise excluded from automatic HTML escaping when following standard documentation examples. An attacker can poison the `csrftoken` cookie with malicious HTML or JavaScript. If a victim visits a site on the same top-level domain that sets this cookie and is then redirected to the vulnerable Litestar application, the payload will execute in the victim's browser context. This allows for session hijacking or arbitrary actions on behalf of the user. The vulnerability is addressed in version 2.20.0.
Affected products
- litestar-org Litestar < 2.20.0
Timeline
- 2026-05-20: advisory: GitHub Security Advisory GHSA-542p-wvx7-72m4 published
- 2026-07-28: disclosed: CVE-2026-48060 published to NVD
- 2026-02-08: patched: Version 2.20.0 released