TI-2026-44119 Aliases CVE-2026-61591 GHSA-c67v-vqrp-m5wj

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

LOW 37CWE-345Published 2026-09-16 · Updated 2026-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Tampering
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345 and CWE-915.

Summary

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00225 13th percentileScored 2026-11-07

Fix Fixed djust (djust-org): 1.0.7djust (PyPI): 1.0.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
djust-org	djust	before 1.0.7	1.0.7	Patch available	CNA
—	djust (PyPI)	before 1.0.7	1.0.7	Patch available	GHSA-c67v-vqrp-m5wj

djust Vendordjust-org Affected before 1.0.7 Fixed in 1.0.7 Patch available CNA
djust (PyPI) Vendor— Affected before 1.0.7 Fixed in 1.0.7 Patch available GHSA-c67v-vqrp-m5wj

Remediation

Fix · CNA djust (djust-org) Fixed in 1.0.7
Fix · GHSA-c67v-vqrp-m5wj djust (PyPI) Fixed in 1.0.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-61591
2026-10-03 Alias added: GHSA-c67v-vqrp-m5wj

References

Other 3

TI-2026-40112 Improper authorization in djust-org djust CVSS 3.1HIGH 8.2
TI-2026-78534 Arbitrary file read in djust find_handlers_for_template MCP tool CVSS 3.1LOW 3.3
TI-2026-44127 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path CVSS 4.0HIGH 8.8
TI-2026-44122 djust has an authorization bypass on the WebSocket/SSE mount path CVSS 3.1CRITICAL 9.1
TI-2026-44121 Cross-site request forgery in djust-org djust CVSS 3.1HIGH 8.1
TI-2026-44120 Session fixation in djust-org djust CVSS 3.1HIGH 7.4

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences