CVE-2026-48060: high-severity vulnerability in litestar-org litestar
Litestar: HTML Injection Through CSRF Token
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.1epss 0.4%
from disclosure to weapon0 days
Published on NVDJul 28
1st PoCMay 19
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
litestar-org · litestarpublic PoCs found — 1
githubgithub.com/Blinky-Keys/CVE-2026-48060★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — litestar-org litestar
In the same product, most dangerous first.
CVE-2024-52581HIGHLitestar allows unbounded resource consumption (DoS vulnerability)EPSS 0.8%CVE-2024-32982HIGHLitestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')EPSS 0.7%CVE-2024-42370HIGHLitestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflowEPSS 0.7%CVE-2026-25480MEDIUMFileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)EPSS 0.6%CVE-2026-25478HIGHLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originsEPSS 0.5%CVE-2025-59152HIGHX-Forwarded-For Header Spoofing Bypasses Litestar Rate LimitingEPSS 0.5%