Affected: django-commons django-unicorn

Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.

Affected: PyPI: django-unicorn

## Summary Component state manipulation is possible in `django-unicorn` due to missing access control checks during property updates and method calls. An attacker can bypass the intended `_is_public` protection to modify internal attributes such as `template_name` or trigger protected methods.

## Vulnerability Details: Component Access Control Bypass Security analysis identified that the framework fails to enforce visibility boundaries defined by `_is_public` within the action parsers. Specifically, the logic in `set_property_value()` and `_call_method_name()` utilizes `getattr` and `setattr` directly on component instances without verifying if the target attribute or method is explicitly marked as public.

Vulnerability resides in: - `src/django_unicorn/views/action_parsers/call_method.py` - `src/django_unicorn/views/action_parsers/utils.py`

While Django's template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal `reset()` method.

## Proof of Concept (PoC) Attacker can overwrite the `template_name` attribute by sending a crafted JSON payload to the message endpoint:

1. Construct a payload targeting a protected attribute: ```json { "actionQueue": [ { "type": "syncInput", "payload": { "name": "template_name", "value": "admin/base.html" } }…