Djust Vulnerability in LiveView-Style Reactivity for Django with Rust Performance
CVE-2026-61589

6.3MEDIUM

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61589?

The Djust framework, which provides reactive server-side rendering for Django using Rust for enhanced performance, has a significant vulnerability in its WebSocket handling. Prior to version 1.0.7, the handle_mount and ViewRuntime._build_request were incorrectly reconstructing HttpRequest instances without including the HTTP_HOST, defaulting to 'testserver' during live sessions. This misconfiguration led to tenant resolution failures; specifically, a None response was returned when it should have resolved to the correct tenant, allowing for potential cross-tenant data disclosure when STRICT_MODE was disabled. This issue has been addressed in version 1.0.7, where the framework now extracts the Host from the ASGI scope, validating it against the specified ALLOWED_HOSTS, and reconstructing the request to ensure consistent tenant resolution and security.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.