- Latest release
- 1.2.7 (Nov 7, 2026): no advisory affects it
- Newest unaffected release
- 1.2.7 (Nov 7, 2026), the latest release
- Advisories
- 14 · 1 critical, 9 high, 3 medium, 1 low
- Weekly downloads
- 3,612
- Dependents
- 0
- Releases
- 78 since 0.1.0 (Jan 16, 2026)
- Registry
- PyPI
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-113731Affects 0.9.0 to 1.0.9 (1.0.10 is outside it); 1.1.0 to 1.1.6 (1.1.7 is outside it); 1.2.0 to 1.2.3 (1.2.4 is outside it); 1.3.0rc4 to 1.3.0rc7 (1.3.0rc8 is outside it)
- CVE-2026-61599Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61589Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61596Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61588Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61594Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61591Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61592Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61597Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61593Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61595Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-61598Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
Show all 14 advisoriesShow fewer advisories
- CVE-2026-61590Affects 0.1.0 to 1.0.6 (1.0.7 is outside it)
- CVE-2026-55571Affects 0.1.0 to 1.0.3 (1.0.4 is outside it)
Advisories 14
- CVE-2026-113731Low 3.3
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
Affected: from 0.9.0, fixed in 1.0.10; from 1.1.0, fixed in 1.1.7; from 1.2.0.dev0, fixed in 1.2.4; from 1.3.0.dev0, fixed in 1.3.0rc8.
Fixed in 1.0.10 (released Oct 11, 2026, 9 days before disclosure), 1.1.7 (released Oct 11, 2026, 9 days before disclosure), 1.2.4 (released Oct 15, 2026, 5 days before disclosure) and 1 other version.
The latest release, 1.2.7, is not affected.
- CVE-2026-61599High 8.8
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
Affected: fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61589Medium 6.3
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on…
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61596High 7.1
djust has broken object-level access control (IDOR)
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61588Medium 6.5
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute…
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61594Critical 9.1
djust has an authorization bypass on the WebSocket/SSE mount path
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61591High 8.1
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61592High 7.4
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session…
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61597Medium 5.1
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61593High 8.1
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61595High 7.7
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61598High 7.1
Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-61590High 7.4
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only…
Affected: fixed in 1.0.7; fixed in 1.0.7.
Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure).
The latest release, 1.2.7, is not affected.
- CVE-2026-55571High 8.2
djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated…
Affected: fixed in 1.0.4.
Fixed in 1.0.4 (released Jun 14, 2026, 72 days before disclosure).
The latest release, 1.2.7, is not affected.