CVE-2026-48060

HighCVSS 8.1

Published: 28/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

Litestar, an ASGI framework, prior to version 2.20.0 is vulnerable to HTML Injection which can be escalated to Cross Site Scripting (XSS) when a template engine is used with CSRF protection and the CSRF cookie contents are not automatically escaped by the template engine if configured per documentation recommendations.

Risk Assessment

The organization is at risk of XSS attacks that could lead to user session theft, account takeover, or data leakage if the application uses a vulnerable configuration.

Recommendation

Upgrade Litestar to version 2.20.0 or later, which contains the fix.

Other vulnerabilities in Litestar

CVE-2026-48061Medium
Litestar prior to version 2.22.0 contains a vulnerability in AllowedHostsMiddleware that allows an attacker to bypass allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. Since X-Forwarded-Host is client-controllable, this enables host header injection attacks.

Original NVD description (English source)

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.