Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 17 September 2026.

Which products and versions are affected?

djust (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1.

Is there a fix for This vulnerability?

Yes. djust (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

djust multiple template-layer cross-site scripting flaws

Severity: info · Published 2026-09-17

djust is a Django web framework templating system used to render dynamic content in web applications. Six separate bugs in djust's auto-escaping mechanism allow attackers to inject JavaScript code that executes in users' browsers, potentially stealing sessions, credentials, or personal data. Exploitation requires no special configuration and can occur through common template patterns like rendering user input with filters or reusing template variables.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 17 September 2026.
Which products and versions are affected?: djust (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1.
Is there a fix for This vulnerability?: Yes. djust (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

djust (PyPI): upgrade to 1.1.1 or later
```
pip install "djust>=1.1.1"
```

Technical details

Six distinct defects in djust template auto-escaping allow attacker-controlled input to bypass HTML escaping and execute as live JavaScript. Vulnerabilities include: filters like linenumbers and linebreaks that fail to escape output, the escape filter acting as a no-op while claiming safety, safeseq/unordered_list incorrectly marking raw strings as safe, persistent safety markers that survive across multiple renders, custom tag handlers emitting unescaped returns, and the render_slot tag echoing context values without escaping. All six are present in 1.1.0 and fixed in 1.1.1.

Affected products

djust djust 1.1.0 and earlier

Timeline

2026-09-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.