Improper Input Validation in djust for Django by djust-org
CVE-2026-61597

5.1MEDIUM

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61597?

The djust framework, which enhances Django applications with reactive server-side capabilities, suffers from a vulnerability in its built-in component template tags. Specifically, prior to version 1.0.7, the framework inadequately validates user-supplied URLs used in href and action attributes. While these URLs are HTML-escaped, this does not mitigate the risks associated with javascript: schemes that could allow for arbitrary JavaScript execution in a user's session. To mitigate this issue, it is essential for developers to sanitize URLs and prevent user-controlled inputs from reaching the component tags. Upgrading to version 1.0.7 resolves this vulnerability.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.