CVE-2026-113731: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in djust-org djust

The djust package, which provides Phoenix LiveView-style reactive server-side rendering for Django, contains a path traversal vulnerability in its MCP tool find_handlers_for_template located in python/djust/mcp/server.py. From versions 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the tool accepts an absolute template_path and reads files without restricting the resolved path to the project or configured template directories. This allows a local MCP client, communicating over local stdio as the same OS user, to use the tool as a file existence and readability oracle and extract substrings matching certain dj-* attribute patterns from files readable by the djust process. The tool does not return arbitrary raw file contents and has no network listener. The vulnerability is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.

An attacker with local access to the MCP tool can probe the file system for readable files and extract specific substrings matching dj-* attribute patterns. This may disclose limited information about file contents but does not allow arbitrary file content disclosure or remote exploitation. The vulnerability has no network exposure and requires local privileges. The CVSS score is 3.3 (low), reflecting limited confidentiality impact and no integrity or availability impact.

Upgrade djust to versions 1.0.10, 1.1.7, 1.2.4, or 1.3.0rc8 or later where the vulnerability is fixed. Since the MCP server communicates only over local stdio and runs as the same OS user, restricting local access to trusted users also mitigates risk. No additional vendor advisory or patch links were provided, so check official djust project resources for updates.