CVE-2026-48060 in Litestar
Summary
by MITRE • 07/28/2026
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in Litestar framework represents a critical security flaw that emerged from the intersection of template engine processing and cross-site request forgery protection mechanisms. This issue affects versions prior to 2.20.0 where developers who configure CSRF protection alongside template engines following official documentation guidelines become susceptible to HTML injection attacks. The root cause lies in how the framework handles automatic escaping of content within template contexts, specifically when CSRF cookies are involved in inline configurations.
The technical implementation flaw stems from improper content sanitization within the template rendering pipeline. When CSRF protection is enabled and configured according to standard documentation practices, the framework fails to properly escape the contents of CSRF cookies before they are rendered into HTML templates. This creates a scenario where malicious actors can inject arbitrary HTML content through CSRF cookie values that bypass the normal escaping mechanisms. The vulnerability manifests because the template engine automatically escapes most content but explicitly excludes CSRF cookie contents from this protection, creating an injection vector.
From an operational impact perspective, this vulnerability enables attackers to escalate simple HTML injection into full cross-site scripting attacks. The compromised state allows malicious users to execute arbitrary JavaScript code within the context of authenticated sessions, potentially leading to session hijacking, data theft, or privilege escalation. The attack surface is particularly concerning because it affects common configuration patterns recommended in official documentation, meaning that developers following best practices for CSRF protection inadvertently expose their applications to this risk.
The security implications extend beyond immediate exploitation as this vulnerability demonstrates a failure in input validation and output encoding within the framework's template processing system. According to CWE standards, this represents a variant of CWE-79 (Cross-site Scripting) with specific characteristics related to improper escaping of template variables. The ATT&CK framework categorizes this under T1566 (Phishing) and T1059 (Command and Scripting Interpreter) as attackers can leverage the XSS capability to deliver malicious payloads or establish persistent access through infected user sessions.
The remediation in version 2.20.0 addresses this by implementing proper content escaping for CSRF cookie values within template contexts, ensuring that all dynamic content from these sources undergoes the same sanitization processes as other template variables. This fix aligns with security best practices for preventing XSS vulnerabilities by enforcing consistent input validation and output encoding across all dynamic content pathways. Organizations should prioritize updating to version 2.20.0 or later while reviewing existing configurations to ensure that no legacy setups continue to use vulnerable inline CSRF template configurations that could expose applications to this class of attack.