CVE-2026-48060 affects Litestar, an ASGI (Asynchronous Server Gateway Interface) Python web framework. Versions prior to 2.20.0 are vulnerable to HTML Injection that can be escalated to Cross-Site Scripting (XSS). The vulnerability arises because the CSRF cookie contents are excluded from automatic escaping by the template engine when configured following the official documentation recommendations. Attackers could exploit this flaw in Litestar instances that use a template engine alongside CSRF protection. The issue has been fully patched in Litestar version 2.20.0. Users are advised to upgrade immediately to mitigate the risk. A security advisory has been published on GitHub under GHSA-542p-wvx7-72m4.