| djust: A template binding inherits a context safety grant it never earned (XSS)CVE-2026-125112 · GHSA-XJW9-38CR-6372 |
djust |
PyPI |
High
|
Fix reported |
|
| djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathCVE-2026-61599 · GHSA-7PRP-2623-8G45Version ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP toolCVE-2026-113731 · GHSA-R57G-MC79-8HJ2 |
djust |
PyPI |
Low
|
Fix reported |
|
| djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live pathCVE-2026-61589 · GHSA-V9RJ-XJFV-XJ9RVersion ranges need review. |
djust |
PyPI |
Medium
|
Fix reported |
|
| djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' dataCVE-2026-61595 · GHSA-3492-CVG7-9MR2Version ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)CVE-2026-61592 · GHSA-F795-P5JW-J6G2Version ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tagsCVE-2026-61597 · GHSA-4MF4-73J6-MVRWVersion ranges need review. |
djust |
PyPI |
Medium
|
Fix reported |
|
| djust has an authorization bypass on the WebSocket/SSE mount pathCVE-2026-61594 · GHSA-XHHM-F6HP-2QWJVersion ranges need review. |
djust |
PyPI |
Critical
|
Fix reported |
|
| djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)CVE-2026-61591 · GHSA-C67V-VQRP-M5WJVersion ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the clientCVE-2026-61588 · GHSA-PVG3-6Q9J-MJ3XVersion ranges need review. |
djust |
PyPI |
Medium
|
Fix reported |
|
| djust has broken object-level access control (IDOR)CVE-2026-61596 · GHSA-C7C5-5J6R-Q957Version ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE sessionCVE-2026-61593 · GHSA-PG97-JVMF-QFVCVersion ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUGCVE-2026-61590 · GHSA-8G2F-G3GQ-5RJVVersion ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handlerCVE-2026-61598 · GHSA-CC7C-9JFF-58WJVersion ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
| djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)GHSA-9395-2G46-RJ3F |
djust |
PyPI |
High
|
Fix reported |
|
| djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler callsCVE-2026-55571 · GHSA-XX4J-W367-7247Version ranges need review. |
djust |
PyPI |
High
|
Fix reported |
|
