Server-Side Rendering Vulnerability in djust by djust.org
CVE-2026-61599

8.8HIGH

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61599?

The djust framework has a vulnerability that allows unauthenticated WebSocket clients to import arbitrary Python modules through the LiveView component. Prior to version 1.0.7, the framework improperly processes client-supplied paths, leading to potential execution of unauthorized code due to the automatic import of modules before validating that they are valid LiveView subclasses. This flaw arises from an inadequate allowlisting mechanism and can be exploited by sending specially crafted requests which trigger the import of uncontrollable modules. Users are advised to update to version 1.0.7 or configure a strict allowlist to limit the impact of this issue. To ensure security, it is essential to review and restrict access to importable modules while maintaining oversight over the lifecycle of WebSocket connections.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.