CVE-2026-48061 Litestar Host Header Injection. Litestar versions prior to 2.22.0 are vulnerable to host header injection attacks due to improper handling of X-Forwarded-Host headers. This allows attackers to bypass allowed hosts validation, potentially leading to password reset poisoning, cache poisoning, and server-side request routing manipulation. Litestar users and administrators should assess exposur [truncated]
CVE-2026-48060 is a high-severity vulnerability in Litestar, an Asynchronous Server Gateway Interface (ASGI) framework. The issue arises when using a template engine with CSRF protection, allowing for HTML injection that can escalate to Cross-Site Scripting (XSS). This occurs because the CSRF cookie contents are excluded from automatic escaping by the template engine. The vulnerability was patched in version 2.20.0.
