djust-org/djust Security Advisories | GitStock

low2026-10-21

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

GHSA-r57g-mc79-8hj2 · CVE-2026-113731

high2026-09-17

djust: A template binding inherits a context safety grant it never earned (XSS)

GHSA-xjw9-38cr-6372

high2026-09-17

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

GHSA-9395-2g46-rj3f

high2026-09-16

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

GHSA-7prp-2623-8g45 · CVE-2026-61599

medium2026-09-16

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

GHSA-v9rj-xjfv-xj9r · CVE-2026-61589

high2026-09-16

djust has broken object-level access control (IDOR)

GHSA-c7c5-5j6r-q957 · CVE-2026-61596

medium2026-09-16

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

GHSA-pvg3-6q9j-mj3x · CVE-2026-61588

critical2026-09-16

djust has an authorization bypass on the WebSocket/SSE mount path

GHSA-xhhm-f6hp-2qwj · CVE-2026-61594

high2026-09-16

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

GHSA-c67v-vqrp-m5wj · CVE-2026-61591

high2026-09-16

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

GHSA-f795-p5jw-j6g2 · CVE-2026-61592

medium2026-09-16

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

GHSA-4mf4-73j6-mvrw · CVE-2026-61597

high2026-09-16

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

GHSA-pg97-jvmf-qfvc · CVE-2026-61593

high2026-09-16

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

GHSA-3492-cvg7-9mr2 · CVE-2026-61595

high2026-09-16

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

GHSA-cc7c-9jff-58wj · CVE-2026-61598

high2026-09-16

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

GHSA-8g2f-g3gq-5rjv · CVE-2026-61590

high2026-08-25

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

GHSA-xx4j-w367-7247 · CVE-2026-55571