{"id":"CVE-2026-61591","title":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance","summary":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was res…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-345","CWE-915"],"vendor":"djust-org","product":"djust","affected":["djust < 1.0.7"],"patched":["djust 1.0.7"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T14:17:14.740","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61591","references":[{"url":"https://github.com/djust-org/djust/releases/tag/v1.0.7","label":"security-advisories@github.com"},{"url":"https://github.com/djust-org/djust/security/advisories/GHSA-c67v-vqrp-m5wj","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-c67v-vqrp-m5wj"},{"url":"https://github.com/djust-org/djust"}],"tags":["nvd","cve.org","ghsa","pip","osv"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-17T13:22:03.701238Z"},"aliases":["GHSA-c67v-vqrp-m5wj"],"ecosystem":"pip","ingestedAt":"2026-09-16T22:06:50.815Z","epss":0.00169,"epssPercentile":0.066,"slug":"CVE-2026-61591","body":"## Overview\n\ndjust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61591)\n\nAffected packages:\n\n- `djust < 1.0.7`\n\nPatched in:\n\n- `djust 1.0.7`\n\nSource: https://github.com/advisories/GHSA-c67v-vqrp-m5wj","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}