# djust (PyPI) vulnerabilities 14 known vulnerabilities (1 critical, 9 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.2.7 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 1.2.7 (Nov 7, 2026), the latest release - Weekly downloads: 3,612 - Dependents: 0 - Releases: 78 since 0.1.0 (Jan 16, 2026) - Registry: https://pypi.org/project/djust/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-113731: 0.9.0 to 1.0.9 (1.0.10 is outside it); 1.1.0 to 1.1.6 (1.1.7 is outside it); 1.2.0 to 1.2.3 (1.2.4 is outside it); 1.3.0rc4 to 1.3.0rc7 (1.3.0rc8 is outside it) - CVE-2026-61599: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61589: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61596: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61588: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61594: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61591: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61592: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61597: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61593: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61595: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61598: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-61590: 0.1.0 to 1.0.6 (1.0.7 is outside it) - CVE-2026-55571: 0.1.0 to 1.0.3 (1.0.4 is outside it) ## Advisories (14) ### [CVE-2026-113731](https://cve.now/CVE-2026-113731): djust: Arbitrary absolute-path file read in the find\_handlers\_for\_template MCP tool - Severity: Low 3.3 - Published: Oct 20, 2026 - Affected: from 0.9.0, fixed in 1.0.10; from 1.1.0, fixed in 1.1.7; from 1.2.0.dev0, fixed in 1.2.4; from 1.3.0.dev0, fixed in 1.3.0rc8. - Fixed in 1.0.10 (released Oct 11, 2026, 9 days before disclosure), 1.1.7 (released Oct 11, 2026, 9 days before disclosure), 1.2.4 (released Oct 15, 2026, 5 days before disclosure) and 1 other version. - The latest release, 1.2.7, is not affected. ### [CVE-2026-61599](https://cve.now/CVE-2026-61599): djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path - Severity: High 8.8 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61589](https://cve.now/CVE-2026-61589): djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on… - Severity: Medium 6.3 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61596](https://cve.now/CVE-2026-61596): djust has broken object-level access control (IDOR) - Severity: High 7.1 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61588](https://cve.now/CVE-2026-61588): djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute… - Severity: Medium 6.5 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61594](https://cve.now/CVE-2026-61594): djust has an authorization bypass on the WebSocket/SSE mount path - Severity: Critical 9.1 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61591](https://cve.now/CVE-2026-61591): djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) - Severity: High 8.1 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61592](https://cve.now/CVE-2026-61592): djust: SSE sessions are not bound to the authenticated user; the client-chosen session\_id is the sole authorization capability (session… - Severity: High 7.4 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61597](https://cve.now/CVE-2026-61597): djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags - Severity: Medium 5.1 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61593](https://cve.now/CVE-2026-61593): djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session - Severity: High 8.1 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61595](https://cve.now/CVE-2026-61595): djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data - Severity: High 7.7 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61598](https://cve.now/CVE-2026-61598): Client mass-assignment of arbitrary view attributes via the default dj-model update\_model handler - Severity: High 7.1 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-61590](https://cve.now/CVE-2026-61590): djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only… - Severity: High 7.4 - Published: Sep 16, 2026 - Affected: fixed in 1.0.7; fixed in 1.0.7. - Fixed in 1.0.7 (released Jun 22, 2026, 86 days before disclosure). - The latest release, 1.2.7, is not affected. ### [CVE-2026-55571](https://cve.now/CVE-2026-55571): djust authentication bypass: a login\_required / on\_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated… - Severity: High 8.2 - Published: Aug 25, 2026 - Affected: fixed in 1.0.4. - Fixed in 1.0.4 (released Jun 14, 2026, 72 days before disclosure). - The latest release, 1.2.7, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/djust Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.