Security Flaw in djust for Django Exposes Sensitive View Attributes

CVE-2026-61598

What is CVE-2026-61598?

The djust framework for Django incorporates a reactive server-side rendering method that unintentionally allows clients to manipulate sensitive server-side attributes. Versions prior to 1.0.7 include a defect where the default event handler, update_model, exposes view attributes to client manipulation without adequate restrictions. Although there are mechanisms like a denylist for certain internal fields, developers may inadvertently allow exposure of critical state variables unless specific measures are implemented. This oversight enables a client to set any existing public attribute, posing a risk for unauthorized access to sensitive data. Upgrading to version 1.0.7 resolves these issues, and a workaround involves strictly defining allowed_model_fields for each view that uses dj-model, ensuring that only intended fields can be manipulated.

References