Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-61597

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

CVSS 4.0 5.1 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-61597

Published

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-supplied URL into an `href` / `action` attribute, HTML-escaping it with `conditional_escape` but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a `javascript:` URI (which needs no escapable characters), so a URL value of `javascript:alert(document.cookie)` lands verbatim in `<a href="javascript:alert(document.cookie)">` and executes in the victim's session on click. Version 1.0.7 contains a fix. As a workaround, do not pass user-controllable URLs to the affected built-in component tags; pre-validate URL schemes in application code before binding them to component arguments.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-61597

Published

djust

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "djust-org",
                    "product": "djust",
                    "versions": [
                        {
                            "version": "< 1.0.7",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON