CVE-2026-34231

{"id": "CVE-2026-34231", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34231", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T17:21:42.383302Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mixxorz", "product": "slippers", "versions": [{"status": "affected", "version": "< 0.6.3"}]}]}], "published": "2026-03-31T16:16:32.603", "references": [{"url": "https://github.com/mixxorz/slippers/commit/16cc4ef4fa8ad2f7aee30798f16c3e7b653423b2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mixxorz/slippers/releases/tag/0.6.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mixxorz/slippers/security/advisories/GHSA-w7rv-gfp4-j9j3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3."}, {"lang": "es", "value": "Slippers es un framework de componentes de UI para Django. Antes de la versi\u00f3n 0.6.3, existe una vulnerabilidad de cross-site scripting (XSS) en la etiqueta de plantilla {% attrs %} del paquete Django slippers. Cuando una variable de contexto que contiene datos no confiables se pasa a {% attrs %}, el valor se interpola en una cadena de atributo HTML sin escape, permitiendo a un atacante salir del contexto del atributo e inyectar HTML o JavaScript arbitrario en la p\u00e1gina renderizada. Este problema ha sido parcheado en la versi\u00f3n 0.6.3."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:django:slippers:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "617012FB-61E8-4B1B-AECD-08D5488A558A", "versionEndIncluding": "0.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}