{"id":"CVE-2026-61589","title":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance","summary":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFac…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-348","CWE-639"],"vendor":"djust-org","product":"djust","affected":["djust < 1.0.7"],"patched":["djust 1.0.7"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T20:16:54.277","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61589","references":[{"url":"https://github.com/djust-org/djust/releases/tag/v1.0.7","label":"security-advisories@github.com"},{"url":"https://github.com/djust-org/djust/security/advisories/GHSA-v9rj-xjfv-xj9r","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-v9rj-xjfv-xj9r"},{"url":"https://github.com/djust-org/djust"}],"tags":["nvd","cve.org","ghsa","pip","osv"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T17:10:32.427871Z"},"aliases":["GHSA-v9rj-xjfv-xj9r"],"ecosystem":"pip","ingestedAt":"2026-09-16T23:07:58.096Z","epss":0.00156,"epssPercentile":0.05116,"slug":"CVE-2026-61589","body":"## Overview\n\ndjust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().get(...)` with no `HTTP_HOST`, so `request.get_host()` defaulted to `\"testserver\"` on the live path. Host/subdomain/domain `TenantResolver`s then misresolved the tenant — `None` on the live path while the HTTP path resolved correctly. With `STRICT_MODE=False` the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against `ALLOWED_HOSTS` (the same logic as the CSWSH Origin gate, parsed with Django's `split_domain_port` so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with `STRICT_MODE=False`.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61589)\n\nAffected packages:\n\n- `djust < 1.0.7`\n\nPatched in:\n\n- `djust 1.0.7`\n\nSource: https://github.com/advisories/GHSA-v9rj-xjfv-xj9r","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}