{"id":"CVE-2026-61599","title":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance","summary":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling …","severity":"high","cvss":8.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-470"],"vendor":"djust-org","product":"djust","affected":["djust < 1.0.7"],"patched":["djust 1.0.7"],"published":"2026-09-16","updated":"2026-09-17","sourceUpdated":"2026-09-17T14:17:14.853","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61599","references":[{"url":"https://github.com/djust-org/djust/releases/tag/v1.0.7","label":"security-advisories@github.com"},{"url":"https://github.com/djust-org/djust/security/advisories/GHSA-7prp-2623-8g45","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-7prp-2623-8g45"},{"url":"https://github.com/djust-org/djust"}],"tags":["nvd","cve.org","ghsa","pip","osv"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-17T13:21:13.251135Z"},"cvssSource":"cna","aliases":["GHSA-7prp-2623-8g45"],"ecosystem":"pip","ingestedAt":"2026-09-16T23:07:58.096Z","epss":0.00377,"epssPercentile":0.31461,"slug":"CVE-2026-61599","body":"## Overview\n\ndjust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling `__import__(module_path, ...)`. The module is imported — running its top-level code (import side effects) — before the framework checks that the resolved object is a `LiveView` subclass and before any per-view authentication. The `LIVEVIEW_ALLOWED_MODULES` allowlist that should contain this is fail-open (`if allowed_modules:` — skipped when the setting is unset, the framework default) and uses loose `startswith` matching. An unauthenticated WebSocket client (the WS handshake does not require auth; per-view auth runs only after import + instantiate) can therefore send a `mount` / `live_redirect_mount` / `url_change` frame (or an SSE mount) with `view = \"<any.importable.module>.AnyName\"` and cause the server to import — and execute the top-level code of — any importable Python module by name. Version 1.0.7 fixes the issue with a fail-closed resolution gate (`djust._view_resolution.is_view_import_allowed`): a client view path resolves only if (a) its module is already loaded (`sys.modules` — so resolving runs no new code; URL-routed views loaded by URLconf at startup keep working with zero config) or (b) it matches `LIVEVIEW_ALLOWED_MODULES` on a module-segment boundary (explicit opt-in for lazily-imported views). The gate runs before `__import__` at all three sinks (+ defense-in-depth inside `_instantiate_view`). As a workaround, set `LIVEVIEW_ALLOWED_MODULES` to the narrow list of modules that contain your mountable LiveView classes. (Note: pre-patch the allowlist is `startswith`-matched and the import still precedes the subclass check, so this is mitigation, not a complete fix.)\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61599)\n\nAffected packages:\n\n- `djust < 1.0.7`\n\nPatched in:\n\n- `djust 1.0.7`\n\nSource: https://github.com/advisories/GHSA-7prp-2623-8g45","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}