https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:57:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275458 EUVD-2026-275458 https://cve.radiocsirt.org/vuln/euvd-2026-275458 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31815 <p>Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.</p> <p>Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipulation is possible in django-unicorn due to missing access control checks during property updates and method calls. An attacker can bypass the intended _is_public protection to modify internal attributes such as template_name or trigger protected methods. This vulnerability is fixed in 0.67.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31815 https://cve.radiocsirt.org/vuln/ghsa-ffv6-jj46-x367 <p><strong>Affected:</strong> PyPI: django-unicorn</p> <p>## Summary Component state manipulation is possible in `django-unicorn` due to missing access control checks during property updates and method calls. An attacker can bypass the intended `_is_public` protection to modify internal attributes such as `template_name` or trigger protected methods.</p> <p>## Vulnerability Details: Component Access Control Bypass Security analysis identified that the framework fails to enforce visibility boundaries defined by `_is_public` within the action parsers. Specifically, the logic in `set_property_value()` and `_call_method_name()` utilizes `getattr` and `setattr` directly on component instances without verifying if the target attribute or method is explicitly marked as public.</p> <p>Vulnerability resides in: - `src/django_unicorn/views/action_parsers/call_method.py` - `src/django_unicorn/views/action_parsers/utils.py`</p> <p>While Django&#39;s template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal `reset()` method.</p> <p>## Proof of Concept (PoC) Attacker can overwrite the `template_name` attribute by sending a crafted JSON payload to the message endpoint:</p> <p>1. Construct a payload targeting a protected attribute: ```json { &#34;actionQueue&#34;: [ { &#34;type&#34;: &#34;syncInput&#34;, &#34;payload&#34;: { &#34;name&#34;: &#34;template_name&#34;, &#34;value&#34;: &#34;admin/base.html&#34; } }…</p> <p><strong>Affected:</strong> PyPI: django-unicorn</p> <p>## Summary Component state manipulation is possible in `django-unicorn` due to missing access control checks during property updates and method calls. An attacker can bypass the intended `_is_public` protection to modify internal attributes such as `template_name` or trigger protected methods.</p> <p>## Vulnerability Details: Component Access Control Bypass Security analysis identified that the framework fails to enforce visibility boundaries defined by `_is_public` within the action parsers. Specifically, the logic in `set_property_value()` and `_call_method_name()` utilizes `getattr` and `setattr` directly on component instances without verifying if the target attribute or method is explicitly marked as public.</p> <p>Vulnerability resides in: - `src/django_unicorn/views/action_parsers/call_method.py` - `src/django_unicorn/views/action_parsers/utils.py`</p> <p>While Django&#39;s template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal `reset()` method.</p> <p>## Proof of Concept (PoC) Attacker can overwrite the `template_name` attribute by sending a crafted JSON payload to the message endpoint:</p> <p>1. Construct a payload targeting a protected attribute: ```json { &#34;actionQueue&#34;: [ { &#34;type&#34;: &#34;syncInput&#34;, &#34;payload&#34;: { &#34;name&#34;: &#34;template_name&#34;, &#34;value&#34;: &#34;admin/base.html&#34; } }…</p> https://cve.radiocsirt.org/vuln/ghsa-ffv6-jj46-x367 https://cve.radiocsirt.org/vuln/pysec-2026-2451 <p><strong>Affected:</strong> PyPI: django-unicorn</p> <p>## Summary Component state manipulation is possible in `django-unicorn` due to missing access control checks during property updates and method calls. An attacker can bypass the intended `_is_public` protection to modify internal attributes such as `template_name` or trigger protected methods.</p> <p>## Vulnerability Details: Component Access Control Bypass Security analysis identified that the framework fails to enforce visibility boundaries defined by `_is_public` within the action parsers. Specifically, the logic in `set_property_value()` and `_call_method_name()` utilizes `getattr` and `setattr` directly on component instances without verifying if the target attribute or method is explicitly marked as public.</p> <p>Vulnerability resides in: - `src/django_unicorn/views/action_parsers/call_method.py` - `src/django_unicorn/views/action_parsers/utils.py`</p> <p>While Django&#39;s template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal `reset()` method.</p> <p>## Proof of Concept (PoC) Attacker can overwrite the `template_name` attribute by sending a crafted JSON payload to the message endpoint:</p> <p>1. Construct a payload targeting a protected attribute: ```json { &#34;actionQueue&#34;: [ { &#34;type&#34;: &#34;syncInput&#34;, &#34;payload&#34;: { &#34;name&#34;: &#34;template_name&#34;, &#34;value&#34;: &#34;admin/base.html&#34; } }…</p> <p><strong>Affected:</strong> PyPI: django-unicorn</p> <p>## Summary Component state manipulation is possible in `django-unicorn` due to missing access control checks during property updates and method calls. An attacker can bypass the intended `_is_public` protection to modify internal attributes such as `template_name` or trigger protected methods.</p> <p>## Vulnerability Details: Component Access Control Bypass Security analysis identified that the framework fails to enforce visibility boundaries defined by `_is_public` within the action parsers. Specifically, the logic in `set_property_value()` and `_call_method_name()` utilizes `getattr` and `setattr` directly on component instances without verifying if the target attribute or method is explicitly marked as public.</p> <p>Vulnerability resides in: - `src/django_unicorn/views/action_parsers/call_method.py` - `src/django_unicorn/views/action_parsers/utils.py`</p> <p>While Django&#39;s template engine restricts rendering to registered directories, an unauthorized user can still force a component to render sensitive templates (e.g., admin layouts) from other installed applications or reset the component state by invoking the internal `reset()` method.</p> <p>## Proof of Concept (PoC) Attacker can overwrite the `template_name` attribute by sending a crafted JSON payload to the message endpoint:</p> <p>1. Construct a payload targeting a protected attribute: ```json { &#34;actionQueue&#34;: [ { &#34;type&#34;: &#34;syncInput&#34;, &#34;payload&#34;: { &#34;name&#34;: &#34;template_name&#34;, &#34;value&#34;: &#34;admin/base.html&#34; } }…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2451