What is the CVSS score of CVE-2026-34231?

CVE-2026-34231 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34231?

Yes, a patch is available for CVE-2026-34231. Update the affected software to the latest version immediately.

Python CVE-2026-34231

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 https://github.com/mixxorz/slippers

GHSA-w7rv-gfp4-j9j3

Python XSS

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 30, 2026 - 17:36 vuln.today

Patch released

Mar 30, 2026 - 17:36 nvd

Patch available

CVE Published

Mar 30, 2026 - 17:20 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on slippers (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.6.3.

DescriptionGitHub Advisory

Summary

A Cross-site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page.

Vulnerability details

Root cause

AttrsNode is a custom Node subclass registered via register.tag(). Unlike register.simple_tag(), which automatically applies conditional_escape() when autoescape is on, custom Node.render() methods receive no automatic escaping and are fully responsible for sanitising their output. attr_string() fails to do this:

python

def attr_string(key: str, value: Any):
    if isinstance(value, bool):
        return key if value else ""
    key = key.replace("_", "-")
    return f'{key}="{value}"'
# value is not escaped

Attack scenario

Given a template that uses {% attrs %} with a user-supplied value:

django

{% load slippers %}
<input {% attrs type placeholder %}>

python

render(request, "search.html", {"placeholder": request.GET.get("q", "")})

An attacker crafting a request with q=" onmouseover="alert(document.cookie)" x=" produces:

html

<input type="text" placeholder="" onmouseover="alert(document.cookie)" x="">

Impact

Any template that passes values derived from user input, database content, or other untrusted sources to {% attrs %} is vulnerable. Successful exploitation can lead to session hijacking, credential theft, arbitrary actions on behalf of the victim, and page defacement.

Remediation

Replace the f-string in attr_string() with format_html(), which escapes both key and value:

python

from django.utils.html import format_html

def attr_string(key: str, value: Any):
    if isinstance(value, bool):
        return key if value else ""
    key = key.replace("_", "-")
    return format_html('{}="{}"', key, value)

Until a patch is available, sanitise untrusted values before passing them to {% attrs %}, for example with django.utils.html.escape() in the view layer.

AnalysisAI

Cross-site scripting (XSS) in the slippers Django package's {% attrs %} template tag allows unauthenticated remote attackers to inject arbitrary HTML and JavaScript by passing untrusted context variables containing quote characters and event handler attributes. The vulnerability affects templates that pass user-supplied or database-derived values to {% attrs %} without prior escaping. Vendor-released patch version 0.6.3 is available.

Technical ContextAI

The slippers package provides a custom Django template tag {% attrs %} implemented as a Node subclass registered via register.tag(). Unlike Django's register.simple_tag(), which automatically applies conditional escaping when autoescape is enabled, custom Node subclasses receive no automatic output sanitization and bear full responsibility for escaping their render() output. The vulnerability exists in the attr_string() function, which constructs HTML attribute strings using an unescaped f-string: f'{key}="{value}"'. When a context variable containing a double quote followed by malicious HTML (such as onmouseover="alert(...)" x=") is passed as a value, the f-string interpolates it directly into the attribute without escaping, allowing attribute context breakout and arbitrary HTML/JavaScript injection. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is the slippers Python package (CPE: pkg:pip/slippers) used in Django applications.

RemediationAI

Vendor-released patch: upgrade slippers to version 0.6.3 or later. The fix replaces the unescaped f-string in the attr_string() function with format_html('{}="{}"', key, value) from django.utils.html, which automatically escapes both key and value for safe HTML attribute insertion. Until patching is possible, apply a workaround by sanitizing untrusted values before passing them to {% attrs %} using django.utils.html.escape() in the view layer. See the vendor security advisory at https://github.com/mixxorz/slippers/security/advisories/GHSA-w7rv-gfp4-j9j3 and the fix commit at https://github.com/mixxorz/slippers/commit/16cc4ef4fa8ad2f7aee30798f16c3e7b653423b2 for implementation details.