Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61599— djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： djust 为 Django 提供了类似 Phoenix LiveView 的响应式服务器端渲染，并借助 Rust 提供高性能支持。 在版本 1.0.7 之前，djust 的实时传输机制通过调用 根据客户端提供的点分路径（dotted path）解析待挂载的 LiveView。该模块会被导入——即执行其顶层代码（产生导入副作用）——这一过程发生在框架检查解析出的对象是否为 的子类之前，同时也发生在任何针对特定视图的认证检查之前。 本应包含该模块的白名单 采用了“故障时开放”（fai

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61599

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling `__import__(module_path, ...)`. The module is imported — running its top-level code (import side effects) — before the framework checks that the resolved object is a `LiveView` subclass and before any per-view authentication. The `LIVEVIEW_ALLOWED_MODULES` allowlist that should contain this is fail-open (`if allowed_modules:` — skipped when the setting is unset, the framework default) and uses loose `startswith` matching. An unauthenticated WebSocket client (the WS handshake does not require auth; per-view auth runs only after import + instantiate) can therefore send a `mount` / `live_redirect_mount` / `url_change` frame (or an SSE mount) with `view = "<any.importable.module>.AnyName"` and cause the server to import — and execute the top-level code of — any importable Python module by name. Version 1.0.7 fixes the issue with a fail-closed resolution gate (`djust._view_resolution.is_view_import_allowed`): a client view path resolves only if (a) its module is already loaded (`sys.modules` — so resolving runs no new code; URL-routed views loaded by URLconf at startup keep working with zero config) or (b) it matches `LIVEVIEW_ALLOWED_MODULES` on a module-segment boundary (explicit opt-in for lazily-imported views). The gate runs before `__import__` at all three sinks (+ defense-in-depth inside `_instantiate_view`). As a workaround, set `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes. (Note: pre-patch the allowlist is `startswith`-matched and the import still precedes the subclass check, so this is mitigation, not a complete fix.)
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust < 1.0.7 -

II. Public POCs for CVE-2026-61599

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61599

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-61599 (1)

Vendor Pages for CVE-2026-61599 (1)

Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total

CVE-2026-61594 9.1 CRITICAL djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61593 8.1 HIGH djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61591 8.1 HIGH djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat
CVE-2026-61595 7.7 HIGH djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan
CVE-2026-61590 7.4 HIGH djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl
CVE-2026-61592 7.4 HIGH djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id
CVE-2026-61598 7.1 HIGH Client mass-assignment of arbitrary view attributes via the default dj-model update_model
CVE-2026-61596 7.1 HIGH djust has broken object-level access control (IDOR)
CVE-2026-61588 6.5 MEDIUM djust's Django model serialization has no sensitive-field denylist: password hashes, privi
CVE-2026-61589 6.3 MEDIUM djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdoma
CVE-2026-61597 5.1 MEDIUM djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component tem

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-470

V. Comments for CVE-2026-61599

No comments yet

Leave a comment