{"action":"Upgrade litestar to 2.22.0 or later.","affected":[{"fixed":"2.22.0","introduced":"0"}],"component":"litestar","cve_ids":["CVE-2026-48060"],"ecosystem":"PyPI","epss":0.00352,"exploited":false,"fixed_versions":["2.22.0"],"ghsa_id":"GHSA-542p-wvx7-72m4","id":"tcs_01M5KH0F2VYSGVSK8FFQ1YRFHA","modified_at":"2026-07-13T16:32:04.539130055Z","published_at":"2026-07-13T15:46:15.800307Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2604","https://github.com/litestar-org/litestar/security/advisories/GHSA-542p-wvx7-72m4","https://docs.litestar.dev/2/release-notes/changelog.html#2.22.0","https://github.com/litestar-org/litestar","https://pypi.org/project/litestar","https://github.com/advisories/GHSA-542p-wvx7-72m4","https://nvd.nist.gov/vuln/detail/CVE-2026-48060"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-2604","url":"https://osv.dev/vulnerability/PYSEC-2026-2604"}],"summary":"Litestar has HTML Injection Through its CSRF Token"}