Local File Access Vulnerability in Djust Framework by Djust Org
CVE-2026-113731
What is CVE-2026-113731?
The Djust framework, which supports Phoenix LiveView-style reactive server-side rendering in Django, is susceptible to a local file access issue. Specifically, the find_handlers_for_template MCP tool does not restrict the resolved path to designated project or template directories, allowing a local attacker to exploit this to check the existence and readability of files. This vulnerability can reveal sensitive substrings from files accessible to the djust process. While the MCP server operates within the same user context and does not enable network connections, it is crucial for users to update to secure versions (1.0.10, 1.1.7, 1.2.4, 1.3.0rc8) to mitigate potential risks.
Affected Version(s)
djust >= 0.9.0, < 1.0.10 < 0.9.0, 1.0.10
djust >= 1.1.0, < 1.1.7 < 1.1.0, 1.1.7
djust >= 1.2.0.dev0, < 1.2.4 < 1.2.0.dev0, 1.2.4