CyberRota Analysis
AI-GeneratedLitestar instances utilizing a template engine with CSRF protection prior to version 2.20.0 are susceptible to HTML Injection, which can lead to Cross-Site Scripting (XSS) attacks due to improper escaping of CSRF cookie contents. Organizations using this framework should prioritize upgrading to version 2.20.0 to mitigate the risk of exploitation. This vulnerability poses a significant threat to web applications relying on Litestar for secure template rendering.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.