Executive brief
djust is a server-side rendering library for Django that provides reactive template updates. A flaw in how it tracks which template variables are safe from HTML escaping allows an attacker to inject malicious JavaScript. When a view marks trusted content as safe under a variable name (like "p"), and a template later reuses that same variable name with untrusted user input, the original safety mark incorrectly carries over to the attacker-controlled value, enabling stored or reflected XSS attacks.
Technical details
The vulnerability exists in djust's context safety mechanism, which tracks safety grants by variable name rather than by value. When a template binding rebinds a variable name that was previously marked safe, the safety grant is inherited by the new binding instead of being replaced, allowing unsafe content to bypass escaping. The attack requires no special template constructs—just ordinary patterns like reusing short variable names (p, item, row) in {% with %}, {% for %}, {% include %}, or assign tags. This affects all versions up to 1.1.1 and is fixed in 1.1.2 by replacing inherited grants rather than copying them.
Affected products
- djust-org djust 0.1.0 through 1.1.1
Timeline
- 2026-09-17: disclosed: Advisory GHSA-xjw9-38cr-6372 published
- 2026-09-17: patched: Fixed in djust 1.1.2