https://vulnerability.circl.lu/sightings/feed 2026-09-19T05:39:35.780439+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/79dc7272-6bba-45da-b93a-e56658e7f100/export 2026-09-19T05:39:35.804633+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "79dc7272-6bba-45da-b93a-e56658e7f100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61588", "type": "seen", "source": "https://gist.github.com/alon710/dac60322612f13505c26a5da70995cbf", "content": "# CVE-2026-61588: CVE-2026-61588: Sensitive Data Exposure via Over-Serialization in djust Framework\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61588\n\n## Summary\nA sensitive data exposure vulnerability exists in the djust framework before version 1.0.7. When serializing Django models to public view attributes, the framework fails to filter out sensitive fields such as passwords, privilege flags, and private tokens, leading to over-serialization and exposure of sensitive records to the client browser.\n\n## TL;DR\ndjust prior to 1.0.7 leaks sensitive database fields (such as user password hashes and administrator flags) to the browser when Django models are bound directly to public LiveView attributes.\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-359\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: Not indexed\n- **Impact**: High Confidentiality Exposure\n- **Exploit Status**: None (Theoretical)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- djust framework (Python package)\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or later to apply built-in floor denylists and customizable serialization controls.\n- Prefix internal view attributes with a leading underscore to prevent client-side serialization.\n- Explicitly serialize only required primitive fields to public attributes instead of assigning complete Django Model instances.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade djust>=1.0.7' to update the package dependency.\n2. Identify all djust LiveView classes in the codebase that assign models to self.\n3. Change public attributes (e.g., self.user) to private attributes (e.g., self._user) or define 'djust_exclude_fields' / 'djust_serializable_fields' inside your Django models.\n\n## References\n\n- [GitHub Security Advisory GHSA-pvg3-6q9j-mj3x](https://github.com/djust-org/djust/security/advisories/GHSA-pvg3-6q9j-mj3x)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61588)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61588) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T10:31:40.413866Z"} 2026-09-17T10:31:40.413866+00:00