GHSA-xjw9-38cr-6372: djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value.

djust’s context safety channel is keyed by name, not by value. Every bind copied the value and left the grant in place:

view marks   p = mark_safe('<b>trusted</b>')
template     {% with p=user_input %}{{ p }}{% endwith %}

djust   '<img src=x onerror=alert(1)>'          <- executes
django  '&lt;img src=x onerror=alert(1)&gt;'