CVE-2026-61598

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61598

In djust versions prior to 1.0.7 , the ModelBindingMixin default update_model handler allows a client to mass-assign any public, existing view attribute over the WebSocket by supplying an arbitrary field name. Protection relies only on a 14-entry denylist of framework internals and an optional al...

CVE-2026-61598

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, "djust.mixins.modelbinding.ModelBindingMixin" provides a default "updatemodel" event handler and is part of the LiveView base MRO, so every LiveView exposes it. I...

EUVD-2026-80768

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

PT-2026-93887

Impact djust.mixins.model binding.ModelBindingMixin provides a default update model event handler and is part of the LiveView base MRO, so every LiveView exposes it. It setattrs a view attribute whose name is client-supplied field, gated only by: reject -prefixed names; reject a 14-entry denylist...