https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:35:11.686404+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-370445 EUVD-2026-370445 2026-10-06T09:35:11.689128+00:00 EUVD-2026-370445 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61591 fkie_cve-2026-61591 2026-10-06T09:35:11.689163+00:00

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

 https://cve.radiocsirt.org/vuln/ghsa-c67v-vqrp-m5wj GHSA-c67v-vqrp-m5wj — djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) 2026-10-06T09:35:11.689222+00:00

Affected: PyPI: djust

### Impact For views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as **trusted** view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to **inject arbitrary view attributes** — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

### Patches Fixed in **djust 1.0.7**. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

### Workarounds Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

 https://cve.radiocsirt.org/vuln/pysec-2026-4040 PYSEC-2026-4040 — djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) 2026-10-06T09:35:11.689281+00:00

Affected: PyPI: djust

### Impact For views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as **trusted** view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to **inject arbitrary view attributes** — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).

### Patches Fixed in **djust 1.0.7**. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.

### Workarounds Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.