django-unicorn affected by component state manipulation via unvalidated attribute access
Priority MEDIUM 63CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284 and CWE-915.
Summary
Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00252 16th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed django-unicorn (django-commons): 0.67.0django-unicorn (PyPI): 0.67.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| django-commons | django-unicorn | before 0.67.0 | 0.67.0 | Patch available | CNA |
| — | django-unicorn (PyPI) | before 0.67.0 | 0.67.0 | Patch available | GHSA-ffv6-jj46-x367 |
- django-unicorn Vendordjango-commons Affected before 0.67.0 Fixed in 0.67.0 Patch available CNA
- django-unicorn (PyPI) Vendor— Affected before 0.67.0 Fixed in 0.67.0 Patch available GHSA-ffv6-jj46-x367
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:django-unicorn:unicorn:*:*:*:*:*:django:*:* | before 0.67.0 | Vulnerable | Django-unicorn |
- cpe:2.3:a:django-unicorn:unicorn:*:*:*:*:*:django:*:* Versions before 0.67.0 Vulnerable ·Django-unicorn
Remediation
- Fix · CNA django-unicorn (django-commons) Fixed in 0.67.0
- Fix · GHSA-ffv6-jj46-x367 django-unicorn (PyPI) Fixed in 0.67.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-31815
- 2026-10-03 Alias added: GHSA-ffv6-jj46-x367
References
More Django-unicorn Unicorn vulnerabilities
- TI-2021-18564 The Unicorn framework through 0.35.3 for Django allows XSS via component.name. CVSS 3.1MEDIUM 5.4
- TI-2021-18642 The Unicorn framework before 0.36.1 for Django allows XSS via a component. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-31815 · CVE Program
- CVE-2026-31815 · NVD
- FIRST EPSS
- GHSA-ffv6-jj46-x367 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences