GHSA-xjw9-38cr-6372: djust: A template binding inherits a context safety grant it never earned (XSS)

A context safety grant was inherited by a template **binding** that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by **name**, not by value. Every bind copied the value and left the grant in place: ``` view marks p = mark_safe(' trusted ') template {% with p=user_input %}{{ p }}{% endwith %} djust ' ' <- executes django '<img src=x onerror=alert(1)>' ``` ## Affected binds Eight distinct shapes were live. …