{"vulnerability": "CVE-2026-6159", "sightings": [{"uuid": "a3b00ef4-8f29-4bc0-a404-585041047658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6159", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjee7zjin62t", "content": "", "creation_timestamp": "2026-04-13T07:36:55.444477Z"}, {"uuid": "a350362d-d092-44b0-8b38-6a9ce427763b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61598", "type": "seen", "source": "https://gist.github.com/alon710/17e19a604dba0f2f8107309615c5a1ab", "content": "# CVE-2026-61598: CVE-2026-61598: Remote State Modification via Mass Assignment in djust Framework\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61598\n\n## Summary\nCVE-2026-61598 is a high-severity mass-assignment vulnerability (CWE-915) affecting the Python package djust prior to version 1.0.7. An authenticated client can supply arbitrary parameter names to modify public view attributes on the server via WebSocket events, leading to unauthorized state manipulation, authorization bypass, or price tampering.\n\n## TL;DR\nA mass-assignment vulnerability in djust allows authenticated clients to modify arbitrary public server-side view attributes via crafted WebSocket payloads.\n\n## Technical Details\n\n- **CWE ID**: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)\n- **Attack Vector**: Network\n- **CVSS v4.0**: 7.1\n- **Exploit Status**: None / No Public PoC\n- **CISA KEV Status**: Not Listed\n- **Remediation**: Upgrade to 1.0.7 or declare explicit allowed_model_fields\n\n## Affected Systems\n\n- Applications implementing python package djust versions < 1.0.7 on Django\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or higher to transition to a safe-by-default posture.\n- Manually override allowed_model_fields on Legacy LiveViews when patching is delayed.\n- Keep sensitive data isolated in private properties or session storage.\n\n**Remediation Steps:**\n1. Run your dependency checker or pip list to verify the current djust version.\n2. Upgrade using the command: pip install --upgrade djust>=1.0.7\n3. Identify instances of dynamic template bindings and configure allowed_model_fields manually if required.\n4. Refactor public LiveView attributes containing authorization or transactional variables to prevent state manipulation.\n\n## References\n\n- [GitHub Security Advisory GHSA-cc7c-9jff-58wj](https://github.com/djust-org/djust/security/advisories/GHSA-cc7c-9jff-58wj)\n- [djust Release Notes v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61598 Record](https://www.cve.org/CVERecord?id=CVE-2026-61598)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61598) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T14:31:54.764638Z"}, {"uuid": "1f88b530-88b3-4acc-ada6-ba30040caf7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61593", "type": "seen", "source": "https://gist.github.com/alon710/4438d7405fbc4cb7f575ade1c1585b2a", "content": "# CVE-2026-61593: CVE-2026-61593: Cross-Site Request Forgery in djust Server-Sent Events Transport Layer\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61593\n\n## Summary\nCVE-2026-61593 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability discovered in the Server-Sent Events (SSE) transport layer of djust, an open-source framework that implements Phoenix LiveView-style reactive server-side rendering for Django applications. Before version 1.0.7, a lack of origin verification on the SSE stream endpoint, combined with @csrf_exempt decorators on message POST endpoints, allowed an attacker to hijack active client sessions through cross-origin interactions.\n\n## TL;DR\nA validation omission in djust allows attackers to hijack reactive user sessions via cross-site requests, mounting unauthorized server-side components and executing state-changing handlers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-352: Cross-Site Request Forgery (CSRF)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.1\n- **Impact**: High (Confidentiality, Integrity)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the djust framework for Django reactive server-side rendering\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade the djust Python package to version 1.0.7 or later.\n- Implement Origin header validation in intermediate reverse proxies.\n- Reject non-JSON Content-Type values on POST requests targeting SSE message endpoints.\n\n**Remediation Steps:**\n1. Update your requirements.txt or Pipfile to specify djust>=1.0.7.\n2. Re-deploy the application to apply the package update.\n3. Verify the fix by attempting a cross-origin connection using an unauthorized Origin header.\n\n## References\n\n- [GitHub Security Advisory GHSA-pg97-jvmf-qfvc](https://github.com/djust-org/djust/security/advisories/GHSA-pg97-jvmf-qfvc)\n- [djust v1.0.7 Release](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61593)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61593) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T16:32:19.994252Z"}, {"uuid": "32d9ec77-9bec-428a-b1e9-dbec171521d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61595", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/35zw2lhjkzs65", "content": "CVE-2026-61595 - djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data\nCVE ID : CVE-2026-61595\n \n Published : Sept. 16, 2026, 3:33 p.m. | 12\u00a0minutes ago\n \n Description : djust provides Phoenix LiveView-style reactive server-side ren...", "creation_timestamp": "2026-09-16T17:18:32.503522Z"}, {"uuid": "f2b33cbc-3037-49d3-a7e0-3edc898903dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61593", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/22eovhmpbg6st", "content": "CVE-2026-61593 - djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session\nCVE ID : CVE-2026-61593\n \n Published : Sept. 16, 2026, 4:17 p.m. | 30\u00a0minutes ago\n \n Description : djust provides Phoenix...", "creation_timestamp": "2026-09-16T17:26:31.838289Z"}, {"uuid": "220d3153-8a4d-4785-9e79-04caa8b52260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61595", "type": "seen", "source": "https://gist.github.com/alon710/add36254cc8a2aecb663b59914ea2d7d", "content": "# CVE-2026-61595: CVE-2026-61595: Multi-Tenancy Isolation Bypass on WebSocket and SSE Paths in djust\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61595\n\n## Summary\nThe multi-tenant isolation mechanism in djust prior to version 1.0.7 fails open on active WebSocket and Server-Sent Events (SSE) connections. Because the tenant context is stored in thread-local variables and initialized exclusively via HTTP middleware, asynchronous event loops executing ASGI/WebSocket code paths do not carry the resolved tenant identifier. When queries are executed without this context, the default database manager fails open, allowing authenticated users of any tenant to query and read sensitive rows across all other tenant accounts.\n\n## TL;DR\nPrior to version 1.0.7, djust does not enforce multi-tenancy boundaries on WebSocket and SSE connection paths. Thread-local context storage is not preserved across ASGI async tasks, leading to an uninitialized tenant ID that defaults to returning unfiltered, global database results to authenticated users.\n\n## Technical Details\n\n- **CWE ID**: CWE-636 / CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.7\n- **Impact**: High (Confidentiality)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust.tenants\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade the djust library dependency to version 1.0.7 or newer\n- Verify that DJUST_STRICT_MODE is configured to True in Django settings\n- Implement Django system checks to verify context-aware query boundaries\n\n**Remediation Steps:**\n1. Modify your project requirements file to require djust>=1.0.7\n2. Execute pip install -r requirements.txt or run pip install --upgrade djust>=1.0.7\n3. Add 'DJUST_STRICT_MODE': True to settings.py inside the DJUST_TENANTS configuration block\n4. Run python manage.py check on development and staging environments to identify system configuration warnings matching code S006\n\n## References\n\n- [Official Advisory (GHSA-3492-cvg7-9mr2)](https://github.com/djust-org/djust/security/advisories/GHSA-3492-cvg7-9mr2)\n- [Release Tag v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61595) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T19:33:34.440039Z"}, {"uuid": "65bfc58f-de27-4d3e-8098-7f1f607e13e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61590", "type": "seen", "source": "https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5", "content": "# CVE-2026-61590: CVE-2026-61590: Network-Exposed Observability Endpoints and Remote Method-Invocation in djust\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61590\n\n## Summary\nA critical access control vulnerability in djust prior to 1.0.7 exposes diagnostic endpoints and remote method-invocation capabilities to unauthorized network actors. The vulnerability arises due to decoupling IP boundary validation into an opt-in middleware that was omitted from official configuration documentation, leaving views to rely solely on the status of Django's DEBUG flag.\n\n## TL;DR\ndjust before 1.0.7 lacks robust view-level validation, allowing remote attackers to execute arbitrary methods via eval_handler when Django DEBUG mode is active and the optional localhost middleware is missing.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-668\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.4\n- **EPSS Score**: Pending\n- **Impact**: Remote Method Execution\n- **Exploit Status**: Proof of Concept / Technical Advisory\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or higher.\n- Ensure Django settings.DEBUG is set to False in all non-local deployment environments.\n- Configure firewall and reverse proxy rules to drop external requests targeting djust diagnostic URIs.\n- Manually add LocalhostOnlyMiddleware to settings.MIDDLEWARE if upgrading is delayed.\n\n**Remediation Steps:**\n1. Execute pip install --upgrade djust>=1.0.7 to pull the updated library.\n2. Open the Django configuration settings file (typically settings.py).\n3. Set DEBUG = False for production environments.\n4. If the middleware was omitted, insert 'djust.middleware.LocalhostOnlyMiddleware' (or equivalent path) into the MIDDLEWARE array.\n5. Restart WSGI/ASGI application server containers to apply configuration changes.\n\n## References\n\n- [GHSA-8g2f-g3gq-5rjv: djust Security Advisory](https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61590 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61590)\n- [djust Repository](https://github.com/djust-org/djust)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61590) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T20:32:38.636466Z"}, {"uuid": "a5acc1d2-7f3b-43fe-9198-3db479b89290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a", "content": "# CVE-2026-61594: CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61594\n\n## Summary\nAn authorization bypass vulnerability exists in the djust framework (djust-org/djust) prior to version 1.0.7. The framework fails to enforce standard Django view-level authorization mechanisms, such as AccessMixins or dispatch decorators, when mounting reactive views over stateful transport layers (WebSockets and Server-Sent Events). Unauthenticated or low-privileged attackers can establish persistent connections to mount arbitrary protected views and execute state-changing event handlers.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Django view-level access controls to mount protected reactive views and execute state-changing event handlers via direct WebSocket or Server-Sent Events (SSE) connections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.1 (Critical)\n- **EPSS Score**: Not listed\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: PoC / Verifiable\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- djust-org/djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or later.\n- Use djust-native class-level declarative authorization attributes instead of HTTP-specific mixins or decorators.\n- Run Django system checks to identify vulnerable LiveView configurations.\n\n**Remediation Steps:**\n1. Upgrade djust to version 1.0.7 via pip/poetry: `pip install djust>=1.0.7`\n2. Scan the codebase for any `LiveView` classes using standard Django `LoginRequiredMixin`, `PermissionRequiredMixin`, or custom overridden `dispatch` methods.\n3. Refactor identified views to use native declarative attributes like `login_required = True` or native djust permission gates.\n4. Execute `python manage.py check` to verify there are no active system check violations (specifically `djust.S004`).\n\n## References\n\n- [GitHub Security Advisory GHSA-xhhm-f6hp-2qwj](https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj)\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [djust Compare v1.0.6...v1.0.7](https://github.com/djust-org/djust/compare/v1.0.6...v1.0.7)\n- [CVE-2026-61594 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T22:31:42.435667Z"}, {"uuid": "979e7a8d-341e-4514-a50a-320a7ed074cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hft3iyt3pw32m", "content": "CVE-2026-61599 - djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path\nCVE ID : CVE-2026-61599\n \n Published : Sept. 16, 2026, 11:16 p.m. | 19\u00a0minutes ago\n \n Description : djust provides Phoenix LiveView-style reactive server-side rendering ...", "creation_timestamp": "2026-09-16T23:56:41.776060Z"}, {"uuid": "5881244b-c9dc-4410-a8c4-bbc404cc0846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a", "content": "# CVE-2026-61594: CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61594\n\n## Summary\nAn authorization bypass vulnerability exists in the djust framework (djust-org/djust) prior to version 1.0.7. The framework fails to enforce standard Django view-level authorization mechanisms, such as AccessMixins or dispatch decorators, when mounting reactive views over stateful transport layers (WebSockets and Server-Sent Events). Unauthenticated or low-privileged attackers can establish persistent connections to mount arbitrary protected views and execute state-changing event handlers.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Django view-level access controls to mount protected reactive views and execute state-changing event handlers via direct WebSocket or Server-Sent Events (SSE) connections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.1 (Critical)\n- **EPSS Score**: Not listed\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: PoC / Verifiable\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- djust-org/djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or later.\n- Use djust-native class-level declarative authorization attributes instead of HTTP-specific mixins or decorators.\n- Run Django system checks to identify vulnerable LiveView configurations.\n\n**Remediation Steps:**\n1. Upgrade djust to version 1.0.7 via pip/poetry: `pip install djust>=1.0.7`\n2. Scan the codebase for any `LiveView` classes using standard Django `LoginRequiredMixin`, `PermissionRequiredMixin`, or custom overridden `dispatch` methods.\n3. Refactor identified views to use native declarative attributes like `login_required = True` or native djust permission gates.\n4. Execute `python manage.py check` to verify there are no active system check violations (specifically `djust.S004`).\n\n## References\n\n- [GitHub Security Advisory GHSA-xhhm-f6hp-2qwj](https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj)\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [djust Compare v1.0.6...v1.0.7](https://github.com/djust-org/djust/compare/v1.0.6...v1.0.7)\n- [CVE-2026-61594 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T00:00:37.086228Z"}, {"uuid": "10badcfa-1be9-41db-8f89-768f4ae3336c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvoegaank725", "content": "\ud83d\udea8 CVE-2026-61594 \u2014 CVSS 9.1 CRITICAL\n\ndjust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performan...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61594\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T00:09:20.600819Z"}, {"uuid": "a54a3a95-d363-464b-b4d2-d478d1cb0088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvoehliwq52n", "content": "CVE-2026-61594 - djust\nThe djust web framework lets users bypass normal login checks when connecting via WebSocket, meaning someone without the right permissions could open a WebSocket and reach admin\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#djust #djustorg #pip #CVE #infosec", "creation_timestamp": "2026-09-17T00:10:05.968015Z"}, {"uuid": "e4c79eb5-9eeb-4781-9c55-db3aa391780c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://gist.github.com/ichintu/3bd86382db78b41a2e654bff6d0c8d75", "content": "**CVE-2026-61599** is a high-severity (8.8) vulnerability in `djust`, a Django package for reactive server-side rendering. Versions prior to 1.0.7 allow **unauthenticated remote code execution** via WebSocket/SSE frames. The flaw occurs because client-supplied module paths are imported before authentication, using a fail-open allowlist with loose `startswith` matching. This enables attackers to execute arbitrary Python code from any importable module. \n\n**Fix & Mitigation:** Patched in **v1.0.7** with a strict fail-closed import gate. Until then, restrict `LIVEVIEW_ALLOWED_MODULES` to a narrow explicit list, though pre-patch configurations remain partially exposed.", "creation_timestamp": "2026-09-17T04:02:11.530184Z"}, {"uuid": "d40905c9-57df-4703-9dc9-2afdd3524aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://gist.github.com/alon710/1597536733cc04eb6b518d3f17d63c1c", "content": "# CVE-2026-61599: CVE-2026-61599: Unauthenticated Arbitrary Module Import in djust Framework\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61599\n\n## Summary\nA critical unauthenticated arbitrary module import vulnerability in the djust framework before version 1.0.7 allows remote attackers to execute arbitrary code by exploiting unsafe Python reflection during LiveView connection mounting.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary code on djust-enabled Django applications via crafted WebSocket payloads exploiting unsafe dynamic Python imports.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-470\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8 (High)\n- **EPSS Score**: Not Assigned\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or later to implement strict, fail-closed view resolution validation.\n- Manually define the LIVEVIEW_ALLOWED_MODULES configuration setting with precise allowed modules to restrict the attack surface.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade djust' or update your project's requirements file to specify djust>=1.0.7.\n2. Verify the installation of djust version 1.0.7 using 'pip show djust'.\n3. In your Django settings.py file, define LIVEVIEW_ALLOWED_MODULES as a list of exact module paths containing authorized views.\n4. Restart all running Django application server instances to apply the configuration updates.\n\n## References\n\n- [GitHub Security Advisory GHSA-7prp-2623-8g45](https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61599 Record](https://www.cve.org/CVERecord?id=CVE-2026-61599)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T07:32:46.942003Z"}, {"uuid": "88d616ce-5a01-4533-9386-d32b8251a657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61596", "type": "seen", "source": "https://gist.github.com/alon710/54d5caa66e0c608481afad4bb0bb44a6", "content": "# CVE-2026-61596: CVE-2026-61596: Broken Object-Level Access Control (IDOR) in djust Framework\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61596\n\n## Summary\nA broken object-level access control (IDOR) vulnerability exists in the djust Django framework prior to version 1.0.7. The framework's per-object authorization hooks were enforced correctly over WebSockets but entirely bypassed on synchronous HTTP GET rendering, SPA client-side navigation, and embedded sub-views, allowing authenticated attackers to view arbitrary unauthorized database records.\n\n## TL;DR\nThe djust framework omitted authorization checks on non-WebSocket rendering paths, allowing authenticated users to bypass object-level permissions and access sensitive records.\n\n## Technical Details\n\n- **CWE ID**: CWE-639, CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.1\n- **EPSS Score**: N/A\n- **Impact**: High (Confidentiality)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust framework\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or later.\n- Manually wrap vulnerable HTTP and template dispatch flows with authorization checks if immediate patching is unfeasible.\n\n**Remediation Steps:**\n1. Verify current djust installation version using pip.\n2. Execute update command to obtain version 1.0.7 or higher.\n3. Run the framework regression test suite to confirm the fix is correctly applied.\n\n## References\n\n- [GitHub Security Advisory GHSA-c7c5-5j6r-q957](https://github.com/djust-org/djust/security/advisories/GHSA-c7c5-5j6r-q957)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61596) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T09:32:22.646780Z"}, {"uuid": "28964bfe-b6e2-4488-9cf9-2b745a7b74b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61591", "type": "seen", "source": "https://gist.github.com/alon710/0d63b7210fa6cfac077576ae0d0c2a4f", "content": "# CVE-2026-61591: CVE-2026-61591: State Snapshot Injection and Mass Assignment in djust Framework\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61591\n\n## Summary\nCVE-2026-61591 is a high-severity state injection and authorization bypass vulnerability affecting the djust framework's opt-in State Snapshot feature. Prior to version 1.0.7, the framework restored public view state snapshots returned from the client browser during back-navigation without validating their cryptographic authenticity or integrity. This flaw allows malicious clients to manipulate serialized JSON payloads to inject unauthorized properties, leading to mass assignment (CWE-915) and privilege escalation. Version 1.0.7 addresses this issue by introducing HMAC cryptographic signatures bound to both the view configuration and the user's session identifier.\n\n## TL;DR\nUnsigned client-side state snapshots in the djust framework allow remote authenticated attackers to execute arbitrary state injection and mass assignment via tampered WebSocket frames, leading to full privilege escalation. This has been resolved in version 1.0.7 through cryptographic HMAC signatures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-345, CWE-915\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.1 (High)\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n- **Affected Component**: State Snapshot Feature (live_redirect_mount)\n\n## Affected Systems\n\n- djust framework library\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade the djust framework library to version 1.0.7 or higher to implement cryptographic HMAC signatures on all state snapshots.\n- Disable the state snapshot feature globally or on individual views if upgrade cycles cannot be executed immediately.\n- Remove privilege and authorization state variables from the public scope of LiveView classes to prevent state manipulation.\n\n**Remediation Steps:**\n1. Step 1: Inspect the current djust package version in the project requirements.\n2. Step 2: Execute pip install --upgrade djust>=1.0.7 to pull the security update.\n3. Step 3: Update local configuration files and ensure DJUST_STATE_SNAPSHOT_MAX_AGE is defined if custom TTL is required.\n4. Step 4: Re-verify application flows and confirm state restoration works securely with cryptographic signatures.\n\n## References\n\n- [GHSA-c67v-vqrp-m5wj: Cryptographic state-snapshot signature bypass in djust](https://github.com/djust-org/djust/security/advisories/GHSA-c67v-vqrp-m5wj)\n- [djust v1.0.7 Release Details and Changelog](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [Patched Source Code Implementation for Secure Snapshot Serialization](https://raw.githubusercontent.com/djust-org/djust/v1.0.7/python/djust/security/state_snapshot.py)\n- [Official Regression Test Coverage verifying cryptographic verification](https://raw.githubusercontent.com/djust-org/djust/v1.0.7/python/djust/tests/test_state_snapshot_signing.py)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61591) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T11:31:44.737869Z"}, {"uuid": "13f571d0-1f5c-43eb-b23b-efe9715eaba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61592", "type": "seen", "source": "https://gist.github.com/alon710/3c02b26d6c320787bd1ad9415b67e503", "content": "# CVE-2026-61592: CVE-2026-61592: Session Hijacking and Authorization Bypass in djust SSE Transport\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61592\n\n## Summary\nA high-severity session hijacking and authorization bypass vulnerability has been identified in the djust framework prior to version 1.0.7. The flaw resides in the Server-Sent Events (SSE) transport implementation, which keyed sessions solely by client-provided session identifiers without verifying session ownership or binding. This allows an attacker who possesses or guesses a victim's session identifier to send malicious post messages to execute arbitrary state machine event handlers under the identity and permissions of the victim.\n\n## TL;DR\nThe djust framework prior to 1.0.7 accepted client-supplied session IDs in the Server-Sent Events (SSE) transport without verifying user ownership, enabling session hijacking and unauthorized state execution.\n\n## Technical Details\n\n- **CWE ID**: CWE-384 / CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 7.4\n- **EPSS Score**: 0.00\n- **Impact**: Session Hijacking / Privilege Escalation\n- **Exploit Status**: none\n- **KEV Status**: not listed\n\n## Affected Systems\n\n- djust-org djust framework, versions prior to 1.0.7\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade the djust library to version 1.0.7 or higher.\n- Disable the SSE transport layer in Django settings to force secure WebSocket transport fallback.\n- Correlate HTTP requests to detect cross-principal session interactions.\n\n**Remediation Steps:**\n1. Verify the installed djust version in your requirements or environment files.\n2. Update djust package dependency to 1.0.7.\n3. Configure DJUST_SSE_ENABLED = False in settings.py if immediate patching is unavailable.\n4. Deploy the updated code to the target environments.\n5. Monitor reverse proxy and application gateway logs for anomalous cross-IP session identifiers.\n\n## References\n\n- [GitHub Security Advisory GHSA-f795-p5jw-j6g2](https://github.com/djust-org/djust/security/advisories/GHSA-f795-p5jw-j6g2)\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [NVD - CVE-2026-61592](https://nvd.nist.gov/vuln/detail/CVE-2026-61592)\n- [CVE Record - CVE-2026-61592](https://www.cve.org/CVERecord?id=CVE-2026-61592)\n- [Wiz Vulnerability Database](https://www.wiz.io/vulnerability-database/cve/cve-2026-61592)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61592) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T12:31:50.608280Z"}, {"uuid": "a115a80e-a214-4c55-b84c-51ac7b289808", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-61597", "type": "seen", "source": "https://gist.github.com/alon710/1b0e2f0ae4c11e6959d410c768da8b7e", "content": "# CVE-2026-61597: CVE-2026-61597: Cross-Site Scripting (XSS) via Unsanitized URI Schemes in djust Component Template Tags\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61597\n\n## Summary\nPrior to version 1.0.7, the djust Python package is vulnerable to Stored and Reflected Cross-Site Scripting (XSS) via component template tags. The underlying issue exists because the package fails to sanitize or validate incoming URI schemes when rendering URLs inside interactive HTML attributes like href or action. While the framework HTML-escapes strings to prevent attribute breakout, it permits the execution of arbitrary JavaScript via the javascript: pseudo-protocol.\n\n## TL;DR\nA vulnerability in djust (< 1.0.7) allows unauthenticated stored or reflected XSS because component template tags fail to validate URI schemes, allowing 'javascript:' payloads to execute directly upon user interaction.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 5.1\n- **EPSS Score**: 0.00%\n- **Impact**: Cross-Site Scripting (XSS)\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust Python package\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or higher\n- Implement strict URI schema validation at the application boundaries\n- Avoid directly rendering raw user inputs inside interactive attributes\n\n**Remediation Steps:**\n1. Identify installed djust version using 'pip show djust'\n2. Upgrade the package to '1.0.7' or newer using pip, poetry, or pipenv\n3. Audit components usage to ensure all URLs are verified\n\n## References\n\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [GitHub Security Advisory GHSA-4mf4-73j6-mvrw](https://github.com/djust-org/djust/security/advisories/GHSA-4mf4-73j6-mvrw)\n- [National Vulnerability Database record for CVE-2026-61597](https://nvd.nist.gov/vuln/detail/CVE-2026-61597)\n- [CVE.org CVE-2026-61597 Record](https://www.cve.org/CVERecord?id=CVE-2026-61597)\n- [Wiz Vulnerability Database analysis for CVE-2026-61597](https://www.wiz.io/vulnerability-database/cve/cve-2026-61597)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61597) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T13:31:34.529621Z"}]}