{"uuid": "e4c79eb5-9eeb-4781-9c55-db3aa391780c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://gist.github.com/ichintu/3bd86382db78b41a2e654bff6d0c8d75", "content": "**CVE-2026-61599** is a high-severity (8.8) vulnerability in `djust`, a Django package for reactive server-side rendering. Versions prior to 1.0.7 allow **unauthenticated remote code execution** via WebSocket/SSE frames. The flaw occurs because client-supplied module paths are imported before authentication, using a fail-open allowlist with loose `startswith` matching. This enables attackers to execute arbitrary Python code from any importable module. \n\n**Fix & Mitigation:** Patched in **v1.0.7** with a strict fail-closed import gate. Until then, restrict `LIVEVIEW_ALLOWED_MODULES` to a narrow explicit list, though pre-patch configurations remain partially exposed.", "creation_timestamp": "2026-09-17T04:02:11.530184Z"}