CVE-2026-48060CWE-79

Litestar: HTML Injection Through CSRF Token

High · published July 28, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-28T19:02Z
EPSS history
Timeline
  • 28 JUL 19:02Z
    Litestar: HTML Injection Through CSRF Token
    cvelistv5