Slippers, a UI component framework for Django, contains an unescaped rendering flaw in its {% attrs %} template tag. When a context variable with untrusted data is interpolated into an HTML attribute string, the value is inserted without escaping, permitting an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript. This classic cross‑site scripting weakness (CWE‑79) can compromise the integrity of rendered pages and potentially expose users to malicious scripts.

The vulnerability affects the mixxorz Slippers package, a Django UI component framework. Any installation of Slippers prior to version 0.6.3 is susceptible; the issue was patched in release 0.6.3.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can supply untrusted input that is rendered via the {% attrs %} tag in a page. Once triggered, the attacker can inject malicious scripts that execute in the context of the victim's browser.