The vulnerability arises when the djust template engine improperly propagates a context‑safety grant from a previously escaped variable to a newly bound variable that contains attacker‑controlled data. If an attacker can influence the value bound to a name that had previously been marked safe, the resulting output will be rendered without escaping, enabling storage of or reflection of malicious script. The flaw is categorized as CWE‑79 (Cross‑Site Scripting) and CWE‑116 (Incorrect Encoding or Escaping).

Django applications using the djust package are affected when running any version prior to 1.0.10 and 1.1.2. The vulnerability is mitigated in release versions 1.0.10 and later, as well as in 1.1.2 and subsequent releases. The affected component is the template binding logic of djust.

The CVSS score of 2.3 indicates a low severity flaw, but the impact can still be significant as it allows arbitrary client‑side code execution in the context of the rendered page. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply template data or modify the template itself, and the vulnerable template must be executed in a user’s browser. When these conditions are met, the cross‑site scripting impact is the same as any typical XSS scenario, enabling credential hijacking, phishing, or defacement.