Litestar has HTML Injection Through its CSRF Token
Date: 2026-06
Affected: pip/litestar
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25478
CVE-2026-48060
CWE: CWE-79
CWE-942
CVSS: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)

# Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. We used the latest Litestar version available via PyPI for this disclosure. At the time of writing, that is version 2.21.0 and we have not validated this against the current latest commit on the main branch. # Special Configurations Required For a web application to be vulnerable to this issue, it must: - Use templates to render the content which is returned to the user (e.g. Jinja, Mako, MiniJinja) - Have CSRF protection enabled - Have CSRF inputs enabled (i.e. a hidden form field which contains the CSRF token) **Links to relevant documentation for the above configurations:** - https://docs.litestar.dev/2/usage/templating.html - https://docs.litestar.dev/latest/usage/middleware/builtin-middleware.html#csrf - https://docs.litestar.dev/latest/usage/templating.html#adding-csrf-inputs # Reproduction Steps 1. Visit an application which contains a form, uses templating, has CSRF protection enabled, and which inserts the CSRF token as a hidden `input` field on forms. A proof of concept application demonstrating this configuration is included later in this disclosure for ease of reproduction. 2. Observe that the server sets the `csrftoken` cookie


Mitigations:

Architectural layers (MAESTRO):