Vulnerabilities

TI-2026-78534 CVE-2026-113731 · GHSA-r57g-mc79-8hj2

Arbitrary file read in djust find_handlers_for_template MCP tool

MEDIUM 49

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00187 Published 2026-10-20 Fixed in 1.0.10, 1.1.7 +2 CWE-22

TI-2026-44127 CVE-2026-61599 · GHSA-7prp-2623-8g45

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

MEDIUM 45

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00604 Published 2026-09-16 Fixed in 1.0.7 CWE-470

TI-2026-44117 CVE-2026-61589 · GHSA-v9rj-xjfv-xj9r

Authorization bypass in djust-org djust

LOW 27

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00178 Published 2026-09-16 Fixed in 1.0.7 CWE-348

TI-2026-44124 CVE-2026-61596 · GHSA-c7c5-5j6r-q957

djust has broken object-level access control (IDOR)

LOW 31

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00328 Published 2026-09-16 Fixed in 1.0.7 CWE-639

TI-2026-44116 CVE-2026-61588 · GHSA-pvg3-6q9j-mj3x

Information disclosure in djust-org djust

LOW 29

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00386 Published 2026-09-16 Fixed in 1.0.7 CWE-200

TI-2026-44122 CVE-2026-61594 · GHSA-xhhm-f6hp-2qwj

djust has an authorization bypass on the WebSocket/SSE mount path

MEDIUM 42

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00485 Published 2026-09-16 Fixed in 1.0.7 CWE-306

TI-2026-44119 CVE-2026-61591 · GHSA-c67v-vqrp-m5wj

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

LOW 37

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00225 Published 2026-09-16 Fixed in 1.0.7 CWE-345

TI-2026-44120 CVE-2026-61592 · GHSA-f795-p5jw-j6g2

Session fixation in djust-org djust

LOW 35

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00388 Published 2026-09-16 Fixed in 1.0.7 CWE-384

TI-2026-44125 CVE-2026-61597 · GHSA-4mf4-73j6-mvrw

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

LOW 23

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00412 Published 2026-09-16 Fixed in 1.0.7 CWE-79

TI-2026-44121 CVE-2026-61593 · GHSA-pg97-jvmf-qfvc

Cross-site request forgery in djust-org djust

LOW 37

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00209 Published 2026-09-16 Fixed in 1.0.7 CWE-352

TI-2026-44123 CVE-2026-61595 · GHSA-3492-cvg7-9mr2

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

LOW 34

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00385 Published 2026-09-16 Fixed in 1.0.7 CWE-636

TI-2026-44126 CVE-2026-61598 · GHSA-cc7c-9jff-58wj

Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

LOW 32

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00429 Published 2026-09-16 Fixed in 1.0.7 CWE-915

TI-2026-44118 CVE-2026-61590 · GHSA-8g2f-g3gq-5rjv

Missing authentication in djust-org djust

LOW 34

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00356 Published 2026-09-16 Fixed in 1.0.7 CWE-306

TI-2026-40112 CVE-2026-55571 · GHSA-xx4j-w367-7247

Improper authorization in djust-org djust

HIGH 75

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00505 Published 2026-08-25 Fixed in 1.0.4 CWE-285

Vulnerabilities

Filters