CVE-2026-34231

Katalog CVE

CVSS 6.1 · Medium EPSS 0,34%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada django slippers. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mixxorz/slippers/security/advisories/GHSA-w7rv-gfp4-j9j3 exploit · advisory vendor
• https://github.com/mixxorz/slippers/commit/16cc4ef4fa8ad2f7aee30798f16c3e7b653423b2 patch
• https://github.com/mixxorz/slippers/releases/tag/0.6.3 release notes