130 matches found
gha-lab-ba8e0c4217
ΠΠ²ΡΠΎΠΌΠ°ΡΠΈΠ·ΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ ΠΈΡΡΠ»Π΅Π΄ΠΎΠ²Π°ΡΠ΅Π»ΡΡΠΊΠΈΠΉ Π°ΡΡΠ΅ΡΠ°ΠΊΡ β Π½Π΅ Π²ΡΡΠ΅ΡΡΠΎΡΡΠΈΠΉ ΠΏΡΠΎΠ΅ΠΊΡ. ΠΡΠΎΡ ΡΠ΅ΠΏΠΎΠ·ΠΈΡΠΎΡΠΈΠΉ β ΠΎΠ΄Π½ΠΎΡΠ°Π·ΠΎΠ²Π°Ρ Π»Π°Π±ΠΎΡΠ°ΡΠΎΡΠΈΡ, ΡΠΎΠ·Π΄Π°Π½Π½Π°Ρ Π°Π²ΡΠΎΠΌΠ°ΡΠΈΠ·ΠΈΡΠΎΠ²Π°Π½Π½ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠΎΠΉ Π΄Π»Ρ ΠΌΠ°Π³ΠΈΡΡΠ΅ΡΡΠΊΠΎΠΉ Π΄ΠΈΡΡΠ΅ΡΡΠ°ΡΠΈΠΈ Π² UniversitΓ© Laval ΠΏΠΎ Π²ΠΎΡΠΏΡΠΎΠΈΠ·Π²Π΅Π΄Π΅Π½ΠΈΡ ΠΎΠΏΡΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½Π½ΡΡ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠ΅ΠΉ Π² ΡΠ°Π±ΠΎΡΠΈΡ ΠΏΡΠΎΡΠ΅ΡΡΠ°Ρ GitHub Actions. ΠΡΠΎ Π΄ΠΎΡΠ»ΠΎΠ²Π½ΡΠΉ...
CVE-2026-48060
CVE-2026-48060 - HTML-ΠΈΠ½ΡΠ΅ΠΊΡΠΈΡ Π² Litestar ΡΠ΅ΡΠ΅Π· CSRF-ΡΠΎΠΊΠ΅Π½ ΠΡΠΎΡ ΡΠ΅ΠΏΠΎΠ·ΠΈΡΠΎΡΠΈΠΉ ΡΠΎΠ΄Π΅ΡΠΆΠΈΡ proof of concept ΡΠΊΡΠΏΠ»ΠΎΠΉΡ ΠΈ ΡΡΠ·Π²ΠΈΠΌΠΎΠ΅ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠ΅ Π΄Π»Ρ Π΄Π΅ΠΌΠΎΠ½ΡΡΡΠ°ΡΠΈΠΈ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ HTML-ΠΈΠ½ΡΠ΅ΠΊΡΠΈΠΈ, ΠΏΡΠΈΡΡΡΡΡΠ²ΡΡΡΠ΅ΠΉ Π² Π²Π΅ΡΡΠΈΠΈ 2.21.0 ΡΡΠ΅ΠΉΠΌΠ²ΠΎΡΠΊΠ° Litestar. ΠΠ°ΠΊ Π·Π°ΠΏΡΡΡΠΈΡΡ git clone https://github.com/Blinky-Keys/CVE-2026-48060...
CVE-2026-48061
Litestar prior to v2.22.0 is affected by CVE-2026-48061: AllowedHostsMiddleware may bypass host validation by using X-Forwarded-Host when Host is absent, enabling host-header injection (e.g., password reset links, cache keys, routing decisions). The issue occurs when no reverse proxy strips X-For...
CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...
EUVD-2026-52437
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...
CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...
CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...
CVE-2026-48061: Improper Neutralization of HTTP Headers for Scripting Syntax
Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
EUVD-2026-49994
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
CVE-2026-48060
Litestar (Python ASGI framework) is affected when using a template engine with CSRF protection configured inline with the templating docs. Prior to version 2.20.0, the csrftoken contents could be injected into rendered HTML due to a lack of escaping, enabling HTML injection and potential XSS. The...
CVE-2026-48060: Improper Neutralization of Input During Web Page Generation
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
Litestar has HTML Injection Through its CSRF Token
OverviewLitestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline wi...
PYSEC-2026-2603 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Summary AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a...
PYSEC-2026-2604 Litestar has HTML Injection Through its CSRF Token
Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline...
Litestar and Starlite vulnerable to Path Traversal
SummaryLocal File Inclusion via Path Traversal in LiteStar Static File ServingA Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensiti...