Arbitrary file read in djust find_handlers_for_template MCP tool
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
djust is affected from 0.9.0 before 1.0.10, from 1.1.0 before 1.1.7, from 1.2.0.dev0 before 1.2.4, and from 1.3.0.dev0 before 1.3.0rc8. The find_handlers_for_template MCP tool does not restrict an absolute template_path to the project or template directories (CWE-22). A local MCP client with low privileges can use it to probe file existence and read matching substrings of djust event attributes from files the djust process can read.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path and reads it without restricting the resolved path to the project or configured template directories. A local MCP client can use the tool as a file existence and readability oracle and can obtain substrings that match the tool's dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern from files readable by the djust process. The maintainer assessment states that the MCP server communicates over local stdio as the same operating-system user and has no network listener, and the tool does not return arbitrary raw file contents. This issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| djust-org | djust | 0.9.0 to before 1.0.10; 1.1.0 to before 1.1.7; 1.2.0.dev0 to before 1.2.4; 1.3.0.dev0 to before 1.3.0rc8 | 1.0.10, 1.1.7, 1.2.4, 1.3.0rc8 | Patch available | CNA |
| — | djust (PyPI) | 0.9.0 to before 1.0.10 | 1.0.10 | Patch available | GHSA-r57g-mc79-8hj2 |
| — | djust (PyPI) | 1.1.0 to before 1.1.7 | 1.1.7 | Patch available | GHSA-r57g-mc79-8hj2 |
| — | djust (PyPI) | 1.2.0.dev0 to before 1.2.4 | 1.2.4 | Patch available | GHSA-r57g-mc79-8hj2 |
| — | djust (PyPI) | 1.3.0.dev0 to before 1.3.0rc8 | 1.3.0rc8 | Patch available | GHSA-r57g-mc79-8hj2 |
- djust Vendordjust-org Affected 0.9.0 to before 1.0.10; 1.1.0 to before 1.1.7; 1.2.0.dev0 to before 1.2.4; 1.3.0.dev0 to before 1.3.0rc8 Fixed in 1.0.10, 1.1.7, 1.2.4, 1.3.0rc8 Patch available CNA
- djust (PyPI) Vendor— Affected 0.9.0 to before 1.0.10 Fixed in 1.0.10 Patch available GHSA-r57g-mc79-8hj2
- djust (PyPI) Vendor— Affected 1.1.0 to before 1.1.7 Fixed in 1.1.7 Patch available GHSA-r57g-mc79-8hj2
- djust (PyPI) Vendor— Affected 1.2.0.dev0 to before 1.2.4 Fixed in 1.2.4 Patch available GHSA-r57g-mc79-8hj2
- djust (PyPI) Vendor— Affected 1.3.0.dev0 to before 1.3.0rc8 Fixed in 1.3.0rc8 Patch available GHSA-r57g-mc79-8hj2
Remediation
Upgrade djust to 1.0.10, 1.1.7, 1.2.4 or 1.3.0rc8, the fixed version for each affected release line.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA djust (djust-org) Fixed in 1.0.10, 1.1.7, 1.2.4, 1.3.0rc8
- Fix · GHSA-r57g-mc79-8hj2 djust (PyPI) Fixed in 1.0.10 Advisory →
- Fix · GHSA-r57g-mc79-8hj2 djust (PyPI) Fixed in 1.1.7 Advisory →
- Fix · GHSA-r57g-mc79-8hj2 djust (PyPI) Fixed in 1.2.4 Advisory →
- Fix · GHSA-r57g-mc79-8hj2 djust (PyPI) Fixed in 1.3.0rc8 Advisory →
Timeline
- 2026-10-21 Threatist record created from CVE-2026-113731
- 2026-10-21 Alias added: GHSA-r57g-mc79-8hj2
- 2026-10-21 Fix available: PyPI/[email protected], PyPI/[email protected], PyPI/[email protected] +1 · GHSA-r57g-mc79-8hj2
- 2026-10-21 CVSS score added · GHSA-r57g-mc79-8hj2
- 2026-10-21 Weakness changed · GHSA-r57g-mc79-8hj2
- 2026-10-21 11 new references · GHSA-r57g-mc79-8hj2
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: LOW → MEDIUM
References
Other 10
- https://github.com/djust-org/djust/security/advisories/GHSA-r57g-mc79-8hj2
- https://github.com/djust-org/djust/commit/45a5045793ebe7c9c2df86b0ad34275af6822619
- https://github.com/djust-org/djust/commit/744bccf699c65c815d9379b36236a7c5592a339b
- https://github.com/djust-org/djust/commit/85eed7caaf620bdb08986f2f3bb79432c0d3d715
- https://github.com/djust-org/djust/commit/a62caf6b4ef540ad688d4dfdfa407ff914c78728
- https://github.com/djust-org/djust/releases/tag/v1.0.10
- https://github.com/djust-org/djust/releases/tag/v1.1.7
- https://github.com/djust-org/djust/releases/tag/v1.2.4
- https://github.com/djust-org/djust/releases/tag/v1.3.0rc8
- https://github.com/djust-org/djust
More djust-org vulnerabilities
- TI-2026-40112 Improper authorization in djust-org djust CVSS 3.1HIGH 8.2
- TI-2026-44127 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path CVSS 4.0HIGH 8.8
- TI-2026-44122 djust has an authorization bypass on the WebSocket/SSE mount path CVSS 3.1CRITICAL 9.1
- TI-2026-44121 Cross-site request forgery in djust-org djust CVSS 3.1HIGH 8.1
- TI-2026-44119 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) CVSS 3.1HIGH 8.1
- TI-2026-44120 Session fixation in djust-org djust CVSS 3.1HIGH 7.4
Sources
- CVE-2026-113731 · CVE Program
- CVE-2026-113731 · NVD
- FIRST EPSS
- GHSA-r57g-mc79-8hj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences