CVE-2026-79311: web.py 0.76 XSS Vulnerability

CVE-2026-79311 Overview

CVE-2026-79311 is a Cross-Site Scripting (XSS) vulnerability affecting web.py version 0.76, a lightweight Python web framework. The flaw resides in the render_jinja.__init__() method, where untrusted input can be rendered without proper output encoding. Attackers can inject malicious JavaScript that executes in the context of a victim's browser session. Successful exploitation can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users.

Critical Impact
Unsanitized input processed by the render_jinja initializer allows attackers to execute arbitrary JavaScript in the browsers of users visiting affected web.py applications.

Affected Products

web.py 0.76 (Python web framework)
Applications using the render_jinja rendering component from web.py 0.76
Downstream projects bundling the vulnerable web.py release

Discovery Timeline

2026-09-22 - CVE-2026-79311 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79311

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting (XSS) flaw in the render_jinja.__init__() constructor of web.py 0.76. The initializer accepts template-related parameters and passes them through the rendering pipeline without adequate escaping or sanitization. When attacker-controlled data reaches this initialization path, HTML and JavaScript payloads are embedded directly into rendered responses. Browsers then execute the injected script within the origin of the target application.

This is a client-side injection issue rather than a server-side execution flaw. However, in real deployments the impact extends to account takeover, cookie theft, and abuse of authenticated sessions. The affected component is a rendering primitive, so every route relying on it inherits the exposure.

Root Cause

The root cause is missing output encoding within the render_jinja initialization path. Framework code assumes callers pass safe values, but no defensive escaping is applied before the data participates in template rendering. This aligns with CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker crafts a request containing an HTML or JavaScript payload targeting a parameter that flows into render_jinja.__init__(). When the affected web.py application renders a response using this component, the payload is delivered to the victim's browser and executed. Delivery typically occurs through phishing links or attacker-controlled content embedded in web pages that trigger the vulnerable code path. See the CVE-2026-79311 technical write-up for reproduction details.

No verified proof-of-concept code is published in the enriched data. Refer to the web.py source repository for the exact implementation of the affected method.

Detection Methods for CVE-2026-79311

Indicators of Compromise

HTTP request parameters containing <script>, javascript:, onerror=, or encoded variants targeting endpoints backed by render_jinja.
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting application pages.
Web server access logs showing anomalous query strings or POST bodies with HTML markup targeting template-rendering routes.

Detection Strategies

Inventory Python applications and identify any deployment using web.py 0.76 with the render_jinja renderer.
Enable a Web Application Firewall (WAF) rule set that inspects request parameters for XSS payload patterns.
Perform static analysis on application code to locate calls to render_jinja that pass user-controlled data.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and alert on suspicious template parameters.
Monitor Content Security Policy (CSP) violation reports for evidence of injected inline scripts.
Track browser telemetry for unusual DOM modifications or script executions on pages served by affected applications.

How to Mitigate CVE-2026-79311

Immediate Actions Required

Identify all instances of web.py 0.76 in the environment and prioritize public-facing applications.
Sanitize and escape any user-controlled input before it reaches render_jinja.__init__().
Deploy a Content Security Policy that restricts inline script execution and unauthorized script sources.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for CVE-2026-79311. Monitor the web.py GitHub repository for a security-patched version and upgrade as soon as it becomes available. Review the vulnerability details for the latest guidance.

Workarounds

Wrap calls to render_jinja with explicit HTML-escaping of dynamic inputs using Jinja2 autoescape features.
Enable Jinja2 autoescape globally when constructing the template environment, ensuring variables are HTML-encoded by default.
Deploy WAF signatures that block common XSS payloads targeting affected endpoints until a patched release is deployed.

bash

# Configuration example: enable Jinja2 autoescape when initializing the renderer
# Ensures dynamic values are HTML-escaped before rendering
render = web.template.render_jinja(
    'templates/',
    encoding='utf-8',
    autoescape=True
)