CVE-2026-125112

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.10 djust versions prior to 1.1.2

Description djust fails to revoke output-safety grants when a template bind replaces a value associated with a specific variable name. Because the context safety channel is keyed by name rather than value, a template can rebind a name that previously held safe content to an attacker-controlled value. This allows the new value to be emitted without escaping, including descendant lookups through the rebound name. This issue can lead to stored or reflected cross-site scripting (XSS) when a victim renders an affected template. The issue occurs when using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags to rebind a name that was previously marked as safe via mark safe() or similar framework paths.

Recommendations Update djust to version 1.0.10 or later. Update djust to version 1.1.2 or later. As a temporary workaround, avoid reusing a context name for both mark safe content and untrusted input, and avoid rebinding such names in {% with %}, {% for %}, {% include ... with %} or assign tags.