djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

GHSA-R57G-MC79-8HJ2 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

EUVD-2026-106855

djust: Arbitrary absolute-path file read in the findhandlersfortemplate MCP tool...

CVE-2026-113731

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

CVE-2026-113731

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

CVE-2026-113731

The djust framework (versions 0.9.0 through 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8) contains an arbitrary absolute-path file read vulnerability in the find_handlers_for_template MCP tool located in python/djust/mcp/server.py. The root cause is that the tool accepts an absolute template_path and reads...

CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

PT-2026-119530

Name of the Vulnerable Software and Affected Versions djust versions 0.9.0 through 1.0.9 djust versions 1.1.0 through 1.1.6 djust versions 1.2.0 through 1.2.3 djust versions 1.3.0rc1 through 1.3.0rc7 Description The find handlers for template MCP tool in python/djust/mcp/server.py accepts an...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

ImpactThe djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

PYSEC-2026-4038 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

ImpactThe WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...

PYSEC-2026-4046 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

Impact The WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

ImpactMany djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

PYSEC-2026-4036 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...

PYSEC-2026-4045 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. isstaff / issuperuser, tokens, and other PII to the browser. Because exposing model objec...

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Impactdjust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...

PYSEC-2026-4043 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

Impact SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns or a victim who leaks a sessionid could connect to the message endpoint and dispatch event...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

PYSEC-2026-4037 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Impact Many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...