{"vulnerability": "CVE-2026-61599", "sightings": [{"uuid": "979e7a8d-341e-4514-a50a-320a7ed074cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hft3iyt3pw32m", "content": "CVE-2026-61599 - djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path\nCVE ID : CVE-2026-61599\n \n Published : Sept. 16, 2026, 11:16 p.m. | 19\u00a0minutes ago\n \n Description : djust provides Phoenix LiveView-style reactive server-side rendering ...", "creation_timestamp": "2026-09-16T23:56:41.776060Z"}, {"uuid": "e4c79eb5-9eeb-4781-9c55-db3aa391780c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://gist.github.com/ichintu/3bd86382db78b41a2e654bff6d0c8d75", "content": "**CVE-2026-61599** is a high-severity (8.8) vulnerability in `djust`, a Django package for reactive server-side rendering. Versions prior to 1.0.7 allow **unauthenticated remote code execution** via WebSocket/SSE frames. The flaw occurs because client-supplied module paths are imported before authentication, using a fail-open allowlist with loose `startswith` matching. This enables attackers to execute arbitrary Python code from any importable module. \n\n**Fix & Mitigation:** Patched in **v1.0.7** with a strict fail-closed import gate. Until then, restrict `LIVEVIEW_ALLOWED_MODULES` to a narrow explicit list, though pre-patch configurations remain partially exposed.", "creation_timestamp": "2026-09-17T04:02:11.530184Z"}, {"uuid": "d40905c9-57df-4703-9dc9-2afdd3524aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61599", "type": "seen", "source": "https://gist.github.com/alon710/1597536733cc04eb6b518d3f17d63c1c", "content": "# CVE-2026-61599: CVE-2026-61599: Unauthenticated Arbitrary Module Import in djust Framework\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61599\n\n## Summary\nA critical unauthenticated arbitrary module import vulnerability in the djust framework before version 1.0.7 allows remote attackers to execute arbitrary code by exploiting unsafe Python reflection during LiveView connection mounting.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary code on djust-enabled Django applications via crafted WebSocket payloads exploiting unsafe dynamic Python imports.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-470\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8 (High)\n- **EPSS Score**: Not Assigned\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade djust to version 1.0.7 or later to implement strict, fail-closed view resolution validation.\n- Manually define the LIVEVIEW_ALLOWED_MODULES configuration setting with precise allowed modules to restrict the attack surface.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade djust' or update your project's requirements file to specify djust>=1.0.7.\n2. Verify the installation of djust version 1.0.7 using 'pip show djust'.\n3. In your Django settings.py file, define LIVEVIEW_ALLOWED_MODULES as a list of exact module paths containing authorized views.\n4. Restart all running Django application server instances to apply the configuration updates.\n\n## References\n\n- [GitHub Security Advisory GHSA-7prp-2623-8g45](https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45)\n- [djust v1.0.7 Release Notes](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [CVE-2026-61599 Record](https://www.cve.org/CVERecord?id=CVE-2026-61599)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T07:32:46.942003Z"}]}