{"cve":"CVE-2026-48060","nvd":{"published":"2026-07-28T20:17:25.760","modified":"2026-10-23T23:10:00.157","status":"Deferred","description":"Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-79"],"references":["https://github.com/litestar-org/litestar/releases/tag/v2.20.0","https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4","https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:27.712498749+00:00"},"epss":{"cve":"CVE-2026-48060","score":0.00352,"percentile":0.28574,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-542p-wvx7-72m4","url":"https://osv.dev/vulnerability/GHSA-542p-wvx7-72m4","summary":"Litestar has HTML Injection Through its CSRF Token","modified":"2026-07-13T16:43:29.592655381Z","packages":[{"ecosystem":"PyPI","name":"litestar","purl":"pkg:pypi/litestar","ranges":["<2.22.0"],"fixed":["2.22.0"]}]},{"id":"PYSEC-2026-2604","url":"https://osv.dev/vulnerability/PYSEC-2026-2604","summary":"Litestar has HTML Injection Through its CSRF Token","modified":"2026-07-13T16:32:04.539130055Z","packages":[{"ecosystem":"PyPI","name":"litestar","purl":"pkg:pypi/litestar","ranges":["<2.22.0"],"fixed":["2.22.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}