Listen to this Post
djust 1.1.0 shipped five independent defects in template auto-escaping.
Attacker-controlled input rendered as live markup where Django escapes it.
All are present in 1.1.0 and fixed in 1.1.1.
They share one shape: a filter or grant escapes nothing itself.
It relies on render-time auto-escape, which something downstream removes.
Defect 1: linenumbers never escaped its input (2291).
{{ p|linenumbers|safe }} with p = ‘‘ executes in djust.
Django escapes it; {{ p|linenumbers|truncatechars_html:”5″ }} has no |safe but is affected.
Defect 2: escape was a no-op (2281).
{{ p|escape|safe }} executes in djust; Django emits ‘<img src=x onerror=alert(1)>’.
Django escape is eager conditional_escape returning SafeString.
djust returned input unchanged and let render site escape it.
The security cell is {{ p|escape|safe }}.
A sweep of length-2 and length-3 chains containing escape found 104 live-markup cells.
Defect 3: unordered_list / safeseq handed a string back under a safe grant (2274).
Given a string rather than sequence they emitted nothing and returned input verbatim.
{{ hostile|safeseq }} is exact synonym for |safe with no mark_safe.
Defect 4: safety grant outlived value it was granted for (2300).
Bare {{ p }} is whole reproducer; safe context keys accumulated and never revoked.
render 1: p = mark_safe(‘trusted‘) -> correct.
render 2: p = ‘‘ -> executes.
Defect 5: custom tag handler return emitted raw, including {% render_slot %} (2379).
Reachable with no |safe, no mark_safe, no application code; component slots are enough.
Django SimpleNode.render runs conditional_escape over simple_tag return unless html.
djust inserted return verbatim; return f”Hello {name}” emitted attacker markup live.
Of 221 handlers, render_slot echoes context value unescaped.
{% render_slot p %} with p = ‘‘ executes in djust; Django escapes.
Defect 6: linebreaks / linebreaksbr and |safe was only spelling that worked (2284).
{{ bio|linebreaks }} renders literal ‘
‘ text; {{ bio|linebreaks|safe }} executes.
Impact: stored or reflected XSS, no special configuration; fixed in 1.1.1 and 1.2.0.
DailyCVE Form:
Platform: djust
Version: 1.1.0
Vulnerability : Template auto-escaping XSS
Severity: Unspecified
date: Not provided
Prediction: Already fixed 1.1.1
What Undercode Say:
Analytics
grep -R "|linenumbers|safe" .
grep -R "|escape|safe" .
grep -R "|safeseq" .
grep -R "|unordered_list" .
grep -R "mark_safe" .
grep -R "{% render_slot" .
grep -R "|linebreaks|safe" .
grep -R "|linebreaksbr|safe" .
p = '<img src=x onerror=alert(1)>' hostile = '<img src=x onerror=alert(1)>' bio = '<img src=x onerror=alert(1)>'
{{ p|linenumbers|safe }}
{{ p|linenumbers|truncatechars_html:"5" }}
{{ p|escape|safe }}
{{ hostile|safeseq }}
{{ p }}
{% render_slot p %}
{{ bio|linebreaks }}
{{ bio|linebreaks|safe }}
How Exploit: (Educational Purposes!)
p = '<img src=x onerror=alert(1)>'
{{ p|linenumbers|safe }}
{{ p|escape|safe }}
{{ hostile|safeseq }}
{{ p }}
{% render_slot p %}
{{ bio|linebreaks|safe }}
p = mark_safe('<b>trusted</b>')
p = '<img src=x onerror=alert(1)>'
{{ p }}
Protection: from this CVE
Upgrade 1.1.1
Avoid |safe after any filter
Avoid safeseq/unordered_list on strings
Avoid reusing context variable for mark_safe and untrusted input
1.2.0 fixes application tag handlers and with/for binds
Impact:
Stored or reflected XSS
No special configuration
Defects 3,4,5 no unusual construct
Defect 5 needs component slots
Defect 6 vulnerable spelling only one renders correctly
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
