Python Class Pollution Vulnerability in Django-Unicorn

CVE-2025-24370

Summary

Django-Unicorn, a library that enhances Django with reactive component functionality, is susceptible to a Python class pollution vulnerability. This flaw is associated with the set_property_value function, which can be exploited by attackers remotely. By crafting specific component requests, they can manipulate the second and third parameters of this function, ultimately leading to arbitrary modifications of the Python runtime environment. This vulnerability can be exploited in a multitude of ways, resulting in significant security risks, including Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in virtually every application based on Django-Unicorn. Users are urgently advised to update to version 0.62.0, as there are currently no workarounds for this issue.

References