{"id":"CVE-2026-61593","title":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance","summary":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-352"],"vendor":"djust","product":"djust","affected":["djust < 1.0.7"],"patched":["djust 1.0.7"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:17:23.010","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61593","references":[{"url":"https://github.com/djust-org/djust/releases/tag/v1.0.7","label":"security-advisories@github.com"},{"url":"https://github.com/djust-org/djust/security/advisories/GHSA-pg97-jvmf-qfvc","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-pg97-jvmf-qfvc"},{"url":"https://github.com/djust-org/djust"}],"tags":["nvd","ghsa","pip","cve.org","osv"],"aliases":["GHSA-pg97-jvmf-qfvc"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-16T18:32:11.548072Z"},"ingestedAt":"2026-09-16T15:58:38.762Z","epss":0.00179,"epssPercentile":0.07682,"slug":"CVE-2026-61593","body":"## Overview\n\ndjust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with `credentials: include` to fire state-changing event handlers as the victim. The URL `session_id` is client-chosen (validated only for UUID *format*), so it is not a CSRF token, and a JSON body sent as `text/plain` is a CORS simple request with no preflight. The issue is fixed in 1.0.7. All three SSE endpoints validate the request `Origin` against `ALLOWED_HOSTS` (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require `Content-Type: application/json` (415 otherwise), closing the `text/plain` simple-request bypass. As a workaround, disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61593)\n\nAffected packages:\n\n- `djust < 1.0.7`\n\nPatched in:\n\n- `djust 1.0.7`\n\nSource: https://github.com/advisories/GHSA-pg97-jvmf-qfvc","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}