Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-61597— djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Quick assessment

Affected

djust-org djust

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Djust 为 Django 提供类似 Phoenix LiveView 的响应式服务端渲染，并具备 Rust 驱动的高性能表现。在 1.0.7 版本之前，djust 的许多内置组件模板标签（）会将由开发者或用户提供的 URL 渲染到或属性中。该处理使用进行 HTML 转义，但从未校验 URL 的协议（scheme）。虽然 HTML 转义可以防止属性突破（attribute breakout），但无法中和形式的 URI（因为该 URI 不包含需要转义的特殊字符）。因此，如果传入的 URL 值为，它将原

CVSS 5.1 · Medium EPSS 0.41% · P35 Updated Sep 17, 2026

Possible ATT&CK Techniques 3 AI

T1061 T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise

Affected Version Matrix 1

Vendor	Product	Version Range	Status
djust-org	djust	`< 1.0.7`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Source: CVE Program / CVE List V5

Vulnerability Description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
djust-org	djust	< 1.0.7	-

II. Public POCs for CVE-2026-61597

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61597

请登录查看更多情报信息。

Vendor Pages for CVE-2026-61597 (1)

🔗 Release v1.0.7 · djust-org/djust · GitHub x_refsource_MISC

Other References for CVE-2026-61597 (1)

🔗 Stored/reflected XSS via javascript: URLs in built-in component template tags · Advisory · djust-org/djust · GitHub Read full article x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-61597

Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total

CVE-2026-61594	9.1 CRITICAL	djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61599	8.8 HIGH	djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
CVE-2026-61593	8.1 HIGH	djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61591	8.1 HIGH	djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat
CVE-2026-61595	7.7 HIGH	djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan
CVE-2026-61590	7.4 HIGH	djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl
CVE-2026-61592	7.4 HIGH	djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id
CVE-2026-61598	7.1 HIGH	Client mass-assignment of arbitrary view attributes via the default dj-model update_model
CVE-2026-61596	7.1 HIGH	djust has broken object-level access control (IDOR)
CVE-2026-61588	6.5 MEDIUM	djust's Django model serialization has no sensitive-field denylist: password hashes, privi
CVE-2026-61589	6.3 MEDIUM	djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdoma

IV. Related Vulnerabilities

Same product: djust

Same vendor: djust-org

Same weakness: CWE-79