CVE-2026-48060 | Litestar is an Asynchronous Server Gateway Interface (ASGI) … | CVSS 8.1 HIGH

Description

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.

Metadata

CVE ID: CVE-2026-48060
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-20 18:25 UTC
Published: 2026-07-28 19:02 UTC
Last updated: 2026-07-28 19:39 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: litestar-org / litestar
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
litestar-org	litestar	—	< 2.20.0

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References (2)

https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4 https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4
https://github.com/litestar-org/litestar/releases/tag/v2.20.0 https://github.com/litestar-org/litestar/releases/tag/v2.20.0