djust versions prior to 1.1.2 contain a vulnerability where a template binding inherits a context safety grant it never earned, leading to stored or reflected cross-site scripting (XSS). This occurs when a view marks a value safe (e.g., using mark_safe) and a template later rebinds that name to attacker-controlled input, causing the safety mark to be incorrectly retained. The issue affects multiple template binding constructs such as {% with %}, {% for %}, {% include … with %}, and assign tags. The vulnerability is fixed in version 1.1.2 and later.
Multiple template-layer defects in djust versions prior to 1.1.1 cause attacker-controlled input to be rendered as live markup without proper escaping, resulting in stored or reflected cross-site scripting (XSS). These defects affect various filters and template constructs, including linenumbers, escape, unordered_list, safeseq, render_slot, and linebreaks, allowing untrusted input to execute script code. The vulnerabilities require no special configuration and some are exploitable with typical application usage patterns. The issues are fixed in djust version 1.1.1 and later.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (46b706e618e75dd4f864a55a33a06cfa98c890d310735b1dea71ad86fe299fe6)
The package ships a module (e.py) that prompts for administrator elevation via UAC, archives the contents of %LOCALAPPDATA%\logs with shutil.make_archive, and POSTs the resulting zip to a hardcoded attacker-controlled endpoint at https://sparkling-pine-f202.stilluer-sweden.workers.dev/ using requests.post. The %LOCALAPPDATA%\logs tree commonly contains Discord, browser, and game-tool artifacts including session data. The package's PyPI summary ("Safe bug reporter for sending local logs via Cloudflare Workers") and identifiers such as aiosendletter_logs are cover-story framing for bulk exfiltration of installer-owned data. Separately, pyproject.toml declares the Python stdlib name "ctypes" as an unpinned PyPI runtime dependency, causing pip to resolve and install whatever package currently occupies that registry name and execute its lifecycle code on the installer's machine — a dependency-confusion install-time code path in addition to the primary stealer payload.
## Source: kam193 (4e81e3b63bbe719f6d0bdd42930bb2f3235b8e41cbacf449743bb7dca67c9f08)
Package hides code to exfiltrate files. Most releases target unclear files, but some reveal the goal to exfiltrate sensitive Telegram data.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-aiosendletter
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
CVE-2026-61599 is a high-severity vulnerability in djust versions prior to 1.0.7 that allows unauthenticated WebSocket clients to cause the server to import and execute arbitrary Python modules. This occurs because the live transport resolves LiveView classes from client-supplied module paths using __import__ before validating the class or performing authentication. The default allowlist for permitted modules is fail-open and uses loose matching, enabling unsafe reflection and code execution. Version 1.0.7 introduces a fail-closed check that restricts imports to already loaded modules or explicitly allowed modules, preventing this unsafe behavior.
CVE-2026-61589 affects djust versions prior to 1.0.7 and involves incorrect tenant resolution due to the use of a less trusted source for the HTTP host in WebSocket request reconstruction. This causes tenant-scoped data managers to either return unscoped data (cross-tenant data disclosure) when STRICT_MODE is false or empty querysets when STRICT_MODE is true. The issue is fixed in version 1.0.7 by properly extracting and validating the Host header from the ASGI scope against ALLOWED_HOSTS.
CVE-2026-61596 is an authorization bypass vulnerability in djust prior to version 1.0.7. The flaw allows authenticated users to view or act on objects they are not authorized for via certain render entry points that did not enforce per-object authorization. This includes the initial HTTP GET render, SPA url_change navigation, and embedded child views using {% live_render %}. The issue is fixed in version 1.0.7 by routing all render entry points through a shared permission enforcement chokepoint. No reliable workaround exists other than upgrading.
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as `password` (the hash), privilege flags (e.g. `is_staff` / `is_superuser`), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire. This is fixed in djust 1.0.7. Model serialization applies a secure-by-default sensitive-field denylist (password/hash/token/secret-style fields and known privilege flags are withheld) with an identity-subset fallback. As a workaround, keep `Model` instances on `_private` attributes and expose only the specific fields needed, until patched.
CVE-2026-61594 is a critical vulnerability in djust versions prior to 1.0.7 where WebSocket transport bypasses standard Django authorization mechanisms. This allows anonymous or under-privileged clients to mount views and dispatch handlers over WebSocket that should be protected, including admin functions. The issue arises because authorization is checked via a custom method that does not enforce Django's usual access controls on WebSocket connections. The vulnerability is fixed in djust 1.0.7 by enforcing Django AccessMixin checks on all transports and introducing startup checks for unsafe auth patterns.
djust versions prior to 1.0.7 have a vulnerability where state snapshots embedded in client pages are not integrity-checked. This allows a client to modify unsigned state data, such as privilege flags or account information, and send it back to the server to escalate privileges or tamper with business state. The issue is fixed in version 1.0.7 by signing state snapshots and rejecting unsigned or forged snapshots. As a workaround, disabling state snapshots or avoiding storing authorization state in public view attributes mitigates the risk.
CVE-2026-61592 is a session fixation vulnerability in djust versions prior to 1.0.7. The issue arises because SSE sessions were keyed solely by a client-chosen session_id without binding to the authenticated user, allowing an attacker who obtains a valid session_id to impersonate the victim. This vulnerability is fixed in version 1.0.7 by binding SSE sessions to the owning principal and rejecting cross-principal access. A workaround is to disable the SSE transport.
CVE-2026-61597 is a cross-site scripting (XSS) vulnerability in djust versions prior to 1.0.7. The issue arises because certain built-in component template tags render user-supplied URLs into href or action attributes with HTML escaping but do not validate the URL scheme. This allows javascript: URIs to be injected and executed in the victim's browser when clicked. The vulnerability is fixed in version 1.0.7.
The 'praetorian-mind-rce-test-2026' package on PyPI is identified as malicious. During installation, it exfiltrates environment variables, including cloud tokens, and fingerprints the environment. It claims to be part of a security testing engagement but exhibits clear malicious behavior by stealing sensitive information. Versions 0.0.1, 0.0.2, and 0.0.3 are affected. There is no CVSS score available for this threat.
vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v1/chat/completions calls AudioMediaIO.load_bytes or AudioMediaIO.load_file without passing VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder. An unauthenticated client can therefore submit a small compressed audio input that expands into a very large float32 PCM allocation, bypassing the duration guard already used by /v1/audio/transcriptions and causing an out-of-memory worker crash. Inline data URLs reach this path without being bounded by VLLM_AUDIO_FETCH_TIMEOUT. The issue affects deployments serving an audio-capable model, and authentication changes only the deployment-specific reachability. This issue is fixed in version 0.24.0.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (f74658ebb12f3a5cbf8577a768965f3ae81fbe8a156acc843ecffe3dfe2e5153)
This package does not carry any malicious payload yet, but uses exactly the same technique as other packages from the campaign aiming to mislead LLM security tools.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-openaii
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- obfuscation
- abuses-pth
- cryptominer
- infostealer
- exfiltration-credentials
- files-exfiltration
- exfiltration-ssh-keys
- persistence
- typosquatting
- covering-tracks
The python-fork package on PyPI versions 0.1.0 and 0.1.1 contains malicious code that triggers a fork bomb upon import, potentially destabilizing the system.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb)
The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS records. During analysis, the intended domain was not yet registered. The chosen name suggests relation to the campaign 2026-09-openaii.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-platform-telemetry-client
Reasons (based on the campaign):
- abuses-pth
- data-stored-in-dns
- obfuscation
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380)
Package name `langgrap` is a one-character deletion of `langgraph`, and `__init__.py` re-exports `from langgraph import *` so imports appear to succeed. The installed `langgrap-setup.pth` file contains an `import...; exec(...)` line that Python auto-executes on every interpreter startup (including non-import invocations like `python -V`). The exec payload is XOR(0x5A)+base64 obfuscated and, when decoded, uses curl to download `http://167.86.108.190:7788/lurves-agent.py` to `/tmp/.a` and runs it via `python3 /tmp/.a --daemon`, guarded by a `/tmp/.lurves-planted` marker. The.pth file additionally contains cover-story comments falsely instructing scanners to classify it as clean. This delivers full remote code execution on the installer's host from an unpinned, unverified script fetched over plain HTTP from a bare IP.
## Source: kam193 (80943fa86afe1c0cd0b657339f2125c48de0ca3cf9848b895e2e60ea744b1db9)
Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-openaii
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- obfuscation
- abuses-pth
- cryptominer
- infostealer
- exfiltration-credentials
- files-exfiltration
- exfiltration-ssh-keys
- persistence
- typosquatting
- covering-tracks
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3)
Package name typosquats the popular `transformers` library. The distribution installs a `.pth` file into site-packages, which the Python interpreter auto-executes on every startup. The.pth file prepends decoy comments falsely asserting the package is verified clean, then runs `exec` on a payload obfuscated with base64 and per-byte XOR (key 0x5A). The decoded payload writes an idempotency marker at `/tmp/.lurves-planted`, then invokes `curl` to download `http://16.78.16.190:7788/lurves-agent.py` to `/tmp/a` and runs it via `python3 /tmp/a --daemon` in a detached session (`start_new_session=True`). The destination is a hardcoded bare IP over plaintext HTTP, unpinned and integrity-unchecked. Multi-layer obfuscation and the prompt-injection style comments demonstrate deliberate concealment of the payload.
## Source: kam193 (c6a3963d4a040c2ab6bfcd6a41395bc60c6b5755420157c053b9b88d9befec9a)
Typosquatting package planting a malicious PTH file that during loading Python downloads the next stage. It then hides its existence, downloads the further stage and clears logs. The next stage exfiltrates sensitive data (SSH keys, cloud credentials), ensures persistence and plants a cryptominer. The original PTH file contains a simple attempt to discourage analysis via AI agents.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-openaii
Reasons (based on the campaign):
- Downloads and executes a remote malicious script.
- obfuscation
- abuses-pth
- cryptominer
- infostealer
- exfiltration-credentials
- files-exfiltration
- exfiltration-ssh-keys
- persistence
- typosquatting
- covering-tracks