Threats affecting pkg:github/djust-org/djust

A path traversal vulnerability (CWE-22) exists in djust versions from 0.9.0 up to but not including 1.0.10, 1.1.0 up to 1.1.7, 1.2.0.dev0 up to 1.2.4, and 1.3.0.dev0 up to 1.3.0rc8. The vulnerability occurs in the find_handlers_for_template MCP tool, which accepts an absolute template path and reads files without restricting access to the project or configured template directories. This allows a local MCP client to use the tool as a file existence and readability oracle and extract certain substrings from readable files. The issue is fixed in versions 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8.

CVE-2026-61592 is a session fixation vulnerability in djust versions prior to 1.0.7. The issue arises because SSE sessions were keyed solely by a client-chosen session_id without binding to the authenticated user, allowing an attacker who obtains a valid session_id to impersonate the victim. This vulnerability is fixed in version 1.0.7 by binding SSE sessions to the owning principal and rejecting cross-principal access. A workaround is to disable the SSE transport.

CVE-2026-61597 is a cross-site scripting (XSS) vulnerability in djust versions prior to 1.0.7. The issue arises because certain built-in component template tags render user-supplied URLs into href or action attributes with HTML escaping but do not validate the URL scheme. This allows javascript: URIs to be injected and executed in the victim's browser when clicked. The vulnerability is fixed in version 1.0.7.

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with `credentials: include` to fire state-changing event handlers as the victim. The URL `session_id` is client-chosen (validated only for UUID *format*), so it is not a CSRF token, and a JSON body sent as `text/plain` is a CORS simple request with no preflight. The issue is fixed in 1.0.7. All three SSE endpoints validate the request `Origin` against `ALLOWED_HOSTS` (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require `Content-Type: application/json` (415 otherwise), closing the `text/plain` simple-request bypass. As a workaround, disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.