High severity · published Jul 28, 2026
CVE-2026-48060
Litestar: HTML Injection Through CSRF Token
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
litestar · litestar-org
< 2.20.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48060
github.com
https://github.com/litestar-org/litestar/releases/tag/v2.20.0
github.com
https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4
More from litestar
8.3
CVE-2024-42370
Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow
8.2
CVE-2024-32982
Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
7.5
CVE-2025-59152
X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting
7.5
CVE-2024-52581
Litestar allows unbounded resource consumption (DoS vulnerability)
6.5
CVE-2026-25480
FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)