GHSA-xjw9-38cr-6372

A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by **name**, not by value. Every bind copied the value and left the grant in place: ``` view marks p = mark_safe('<b>trusted</b>') template {% with p=user_input %}{{ p }}{% endwith %} djust '<img src=x onerror=alert(1)>' <- executes django '&lt;img src=x onerror=alert(1)&gt;' ``` ## Affected binds Eight distinct shapes were live. All are fixed in 1.1.2: | shape | example | |---|---| | `{% with %}` rebinding a marked name | `{% with p=hostile %}{{ p }}{% endwith %}` | | `{% with %}` **descendant** of a rebound name | `{% with p=hostile %}{{ p.a }}{% endwith %}` | | `{% with %}` binding over a marked name | `{% with q=hostile %}{{ q }}{% endwith %}` | | `{% for %}` loop variable | `{% for p in hostiles %}{{ p }}{% endfor %}` | | `{% for %}` descendant | `{% for p in hostiles %}{{ p.a }}{% endfor %}` | | `{% for %}` tuple unpacking | `{% for k, v in rows %}{{ v }}{% endfor %}` | | `{% include … with %}` | `{% include "c.html" with q=hostile %}` | | assign tags | `{% … as x %}` | No filter chain and no `|safe` anywhere in the template is required. The precondition is that the application marked *some* value safe under a name that a template later rebinds — an ordinary pattern, since a view commonly marks trusted markup safe and templates commonly reuse short names such as `p`, `item` or `row`. ## Impact Stored or reflected XSS in any djust application that combines `mark_safe` (or any framework path that grants a context key safety) with a template that rebinds that name. Exploitation requires no unusual template construct. ## Patches Fixed in **1.1.2**, and in 1.2.0 (`main`). The rule is that a bind **replaces** the grant rather than inheriting one. It is stated that way deliberately: the originally reported