Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61591

djust · privilege escalation

CVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61591

Published

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-61591

Published

djust

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "djust-org",
                    "product": "djust",
                    "versions": [
                        {
                            "version": "< 1.0.7",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON