rootpwn

high · CVSS v3 8.1

CVE-2026-61591

The djust library (used with Django) allowed unsigned client‑side state snapshots to be accepted as trusted data on reconnect. An attacker c

Overview

The djust library (used with Django) allowed unsigned client‑side state snapshots to be accepted as trusted data on reconnect. An attacker could modify the snapshot to alter public view attributes such as `is_admin`, enabling privilege escalation or business‑logic tampering.

Description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

Impact

Integrity and authorization are compromised: attackers can change public view attributes to gain elevated privileges or manipulate business data. Confidentiality and availability are not directly affected.

Remediation

Upgrade to djust 1.0.7 or later, where state snapshots are signed and verified. As an interim measure, disable state snapshots or avoid storing authorization/ownership data in public view attributes.

Risk context

High severity (CVSS 8.1). The flaw permits privilege escalation and data tampering, making it a critical issue for applications that rely on djust for reactive rendering.

Affected products

  • djust
  • Django djust
  • djust 1.0.6 and earlier

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
—
EPSS
—

privilege-escalation state-snapshot client-side django djust integrity patch

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis