CVE-2026-48060

{
  "id": "CVE-2026-48060",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T20:17:25.760",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0."
    },
    {
      "lang": "es",
      "value": "Litestar es un framework de Interfaz de Pasarela de Servidor Asíncrono (ASGI). Antes de la versión 2.20.0, las instancias de Litestar que utilizan un motor de plantillas junto con la protección CSRF son vulnerables a la Inyección HTML, que puede escalarse a Cross Site Scripting debido a que el contenido de la cookie CSRF se excluye del escape automático por parte del motor de plantillas cuando se configura en línea con las recomendaciones de la documentación. Este problema ha sido parcheado en la versión 2.20.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "litestar-org",
          "product": "litestar",
          "versions": [
            {
              "version": "< 2.20.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T19:38:31.070372Z",
          "id": "CVE-2026-48060",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}