PT-2026-99752

A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by name, not by value. Every bind copied the value and left the grant...