CVE-2026-48060: Litestar: HTML Injection Through CSRF Token

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-28 · updated 2026-10-23
Weakness: CWE-79

Description

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.

Affected products

litestar-org litestar: before 2.20.0

References

https://github.com/litestar-org/litestar/releases/tag/v2.20.0
https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4
https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4

Get alerted when CVE-2026-48060 or the next vulnerability affects your stack