CVE-2026-61597— djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Quick assessment
Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags ( ) render a developer/user-supplied URL into an / attribute, HTML-escaping it wi
Possible ATT&CK Techniques 3 AI
T1061 T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61597
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-61597
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61597
请登录查看更多情报信息。
Vendor Pages for CVE-2026-61597 (1)
-
🔗 Release v1.0.7 · djust-org/djust · GitHub x_refsource_MISC
Other References for CVE-2026-61597 (1)
Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total
| CVE-2026-61594 | 9.1 CRITICAL | djust has an authorization bypass on the WebSocket/SSE mount path |
| CVE-2026-61599 | 8.8 HIGH | djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path |
| CVE-2026-61593 | 8.1 HIGH | djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p |
| CVE-2026-61591 | 8.1 HIGH | djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat |
| CVE-2026-61595 | 7.7 HIGH | djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan |
| CVE-2026-61590 | 7.4 HIGH | djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl |
| CVE-2026-61592 | 7.4 HIGH | djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id |
| CVE-2026-61598 | 7.1 HIGH | Client mass-assignment of arbitrary view attributes via the default dj-model update_model |
| CVE-2026-61596 | 7.1 HIGH | djust has broken object-level access control (IDOR) |
| CVE-2026-61588 | 6.5 MEDIUM | djust's Django model serialization has no sensitive-field denylist: password hashes, privi |
| CVE-2026-61589 | 6.3 MEDIUM | djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdoma |
IV. Related Vulnerabilities
Same product: djust
-
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the -
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the cli -
CVE-2026-61596
djust has broken object-level access control (IDOR) -
CVE-2026-61588
djust's Django model serialization has no sensitive-field de -
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount
Same vendor: djust-org
-
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the -
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the cli -
CVE-2026-61596
djust has broken object-level access control (IDOR) -
CVE-2026-61588
djust's Django model serialization has no sensitive-field de -
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount
Same weakness: CWE-79
-
CVE-2026-92590
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fiel -
CVE-2026-92584
AVideo through 29.0 Stored Cross-Site Scripting via User-Age -
CVE-2026-92814
changedetection.io through 0.60.6 Cross-Site Scripting via w -
CVE-2026-20309
Cisco Identity Services Engine Cross-Site Scripting Vulnerab -
CVE-2026-92418
ChangeWeDer crm Save Endpoint customer.serve.js cross site s
V. Comments for CVE-2026-61597
No comments yet