{"uuid": "d40905c9-57df-4703-9dc9-2afdd3524aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://gist.github.com/alon710/1597536733cc04eb6b518d3f17d63c1c", "content": "# CVE-2026-61599: CVE-2026-61599: Unauthenticated Arbitrary Module Import in djust Framework\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61599\n\n## Summary\nA critical unauthenticated arbitrary module import vulnerability in the djust framework before version 1.0.7 allows remote attackers to execute arbitrary code by exploiting unsafe Python reflection during LiveView connection mounting.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary code on djust-enabled Django applications via crafted WebSocket payloads exploiting unsafe dynamic Python imports.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-470\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8 (High)\n- **EPSS Score**: Not Assigned\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or later to implement strict, fail-closed view resolution validation.\n- Manually define the LIVEVIEW_ALLOWED_MODULES configuration setting with precise allowed modules to restrict the attack surface.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade djust' or update your project's requirements file to specify djust>=1.0.7.\n2. Verify the installation of djust version 1.0.7 using 'pip show djust'.\n3. In your Django settings.py file, define LIVEVIEW_ALLOWED_MODULES as a list of exact module paths containing authorized views.\n4. Restart all running Django application server instances to apply the configuration updates.\n\n## References\n\n- [GitHub Security Advisory GHSA-7prp-2623-8g45](https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61599 Record](https://www.cve.org/CVERecord?id=CVE-2026-61599)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T07:32:46.942003Z"}