CVE-2026-61598
HighCVSS 7.1Summary
A vulnerability in djust (versions prior to 1.0.7) affects the default `update_model` event handler in `ModelBindingMixin`, allowing a client to set any public, existing view attribute over the WebSocket, not just fields bound with `dj-model=`. Protection relies only on rejecting `_`-prefixed names, a 14-entry denylist of framework internals, and an optional allowlist that defaults to allowing all. As a result, an attacker can modify attributes such as `account_id`, `is_admin`, or `total_price` if they are public and exist on the view.
Risk Assessment
An attacker can alter business and authorization state (e.g., account ID, admin flag, price), leading to privilege escalation or data manipulation. The risk is high because the allowlist is off by default and type coercion aids the attack (e.g., `"true"` becomes boolean True).
Recommendation
Upgrade djust to version 1.0.7 or later. If upgrading is not possible, explicitly set `allowed_model_fields` to the minimal list of bindable fields on every view using `dj-model` (or subclassing LiveView), and do not keep authorization/ownership state in public view attributes.
Other vulnerabilities in djust
See all- CVE-2026-61595High
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path; the current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware, so on the live (WebSocket/SSE) path get_current_tenant() was always None and the tenant-aware QuerySet manager failed OPEN, disclosing every tenant's rows. This issue is fixed in djust 1.0.7.
- CVE-2026-61593High
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrf_exempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session and fire state-changing event handlers as the victim. This issue is fixed in 1.0.7.
- CVE-2026-61590High
Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (eval_handler). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely.
- CVE-2026-55571High
djust prior to 1.0.4 does not close the WebSocket or clear the view instance after denying a LiveView mount due to login or permission requirements. A WebSocket client can ignore the redirect and send events that invoke @event_handler methods without authentication, enabling unauthorized sensitive reads or mutations. This issue is fixed in version 1.0.4.
Original NVD description (English source)
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of the LiveView base MRO, so every LiveView exposes it. It `setattr`s a view attribute whose name is client-supplied (`field`), gated only by: reject `_`-prefixed names; reject a 14-entry denylist of framework internals (`FORBIDDEN_MODEL_FIELDS`); optional `allowed_model_fields` which defaults to None = allow all; and `hasattr` existence. As a result, a client can set any public, existing view attribute — not just the fields actually bound with `dj-model=` in the rendered template. The denylist covers framework plumbing but nothing about developer business/authz state, and the allowlist is opt-in (off by default). A developer who binds one `dj-model="search"` input and also keeps `self.account_id` / `self.is_admin` / `self.total_price` as view state does not realize a client can set ALL of them via `{type:event, event:"update_model", params:{field, value}}` over the WebSocket. Type coercion matches the target attribute's type (so `"true"` -> bool True), aiding the attacker. This issue is fixed in djust 1.0.7. As a workaround, set `allowed_model_fields` explicitly on every view using dj-model (or subclassing LiveView) to the minimal list of bindable fields; do not keep authorization/ownership state in public view attributes that share the view with dj-model bindings.