Sensitive Data Exposure in djust for Django by djust
CVE-2026-61588

6.5MEDIUM

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61588?

djust, designed for Phoenix LiveView-style reactive server-side rendering in Django, experienced a significant vulnerability prior to version 1.0.7. This issue arose when Django Model instances were assigned to public view attributes, leading to direct serialization of these instances to the client without a sensitive-field denylist. Consequently, sensitive information, including password hashes, privilege flags, and personally identifiable information (PII), could be unintentionally sent to the browser. This common practice of exposing model objects to templates risked data leakage unbeknownst to developers. The issue has been addressed in djust version 1.0.7, which introduces a secure-by-default denylist for sensitive fields, ensuring that critical data remains protected. As a temporary measure, developers are advised to keep Model instances on _private attributes and expose only necessary fields until the software is updated.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.