CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61590

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-61598

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61598

In djust versions prior to 1.0.7 , the ModelBindingMixin default update_model handler allows a client to mass-assign any public, existing view attribute over the WebSocket by supplying an arbitrary field name. Protection relies only on a 14-entry denylist of framework internals and an optional al...

CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

EUVD-2026-80768

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object...

CVE-2026-61590

djust is a library providing Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7 , its observability endpoints exposed live view/session state and a remote method-invocation surface (eval_handler). The root cause is that the local...

CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

EUVD-2026-80744

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CLSA-2026-1789538853 TuxCare security update for django (3 CVEs)

TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post10+tuxcare...

CLSA-2026-1789538082 TuxCare security update for django (4 CVEs)

TuxCare rebuilt django to address 4 CVEs. Fixed in 5.0.post13+tuxcare...

CVE-2026-61598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61599: Use of Externally-Controlled Input to Select Classes or Code

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61594: Missing Authentication for Critical Function

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

Fedora 44 : python-django6 (2026-6613125727)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6613125727 advisory. Update python-django6 providing python3-django to the latest 6.1.1 release Tenable has extracted the preceding description block directly from the...

CVE-2026-61588: Exposure of Sensitive Information to an Unauthorized Actor

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...

CVE-2026-61593: Cross-Site Request Forgery (CSRF)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...