Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34231Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag

Medium 6.1

In plain English

A medium-severity cross-site scripting in slippers from mixxorz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	slippers	0.6.3	GHSA-w7rv-gfp4-j9j3
PyPI	slippers	0.6.3	PYSEC-2026-2279

Affected products (as reported)

Vendor	Product	Versions
mixxorz	slippers	< 0.6.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/mixxorz/slippers/security/advisories/GHSA-w7rv-gfp4-j9j3 x_refsource_CONFIRM
https://github.com/mixxorz/slippers/commit/16cc4ef4fa8ad2f7aee30798f16c3e7b653423b2 x_refsource_MISC
https://github.com/mixxorz/slippers/releases/tag/0.6.3 x_refsource_MISC