EUVD-2026-81302

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity chec...

CVE-2026-61591

djust (a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance) is vulnerable to privilege escalation and state injection prior to version 1.0.7 . When views opt into state snapshots, the unsigned state_json embedded in the client page was restor...

CVE-2026-61591 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity chec...

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Impact For views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view...