{"action":"Upgrade litestar to 2.22.0 or later.","affected":[{"fixed":"2.22.0","introduced":"0"}],"component":"litestar","cve_ids":["CVE-2026-48060"],"ecosystem":"PyPI","epss":0.00352,"exploited":false,"fixed_versions":["2.22.0"],"ghsa_id":"GHSA-542p-wvx7-72m4","id":"tcs_01M5KEZS4BX5C28YHNQ263D1KH","modified_at":"2026-07-13T16:43:29.592655381Z","published_at":"2026-06-10T19:12:05Z","references":["https://osv.dev/vulnerability/GHSA-542p-wvx7-72m4","https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4","https://docs.litestar.dev/2/release-notes/changelog.html#2.22.0","https://github.com/litestar-org/litestar"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-542p-wvx7-72m4","url":"https://osv.dev/vulnerability/GHSA-542p-wvx7-72m4"}],"summary":"Litestar has HTML Injection Through its CSRF Token"}